#PHP2Shell
Critical PHP RCE (CVE-2026-109618, CVE-2026-109619). Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.
IOCs by window
0
IOCs tagged #PHP2Shell
0
IOCs tagged #PHP2Shell
24
IOCs tagged #PHP2Shell
24
IOCs tagged #PHP2Shell
Counts as of 2026-11-10. Regenerated daily.
2026-10-28 17:21 UTC: fix out · in CISA KEV since 26 Oct · attacks reported by Cloudflare, watchTowr, Patchstack
About #PHP2Shell
- CVEs: CVE-2026-109618 (OOM corruption), CVE-2026-109619 (stale global state).
- Severity: CVSS 4.0: 9.2 (PHP). NVD CVSS 3.1: 9.8 and 8.1.
- Impact: Unauthenticated RCE.
- Third CVE: CVE-2026-115560: rare session setup. Fix in the next release.
- At risk: PHP-FPM, mod_php (highest risk), php-cgi, FrankenPHP, LiteSpeed.
- Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a distro backport.
- Exploited: In CISA KEV since 26 Oct. Attacks on PAN-OS management interfaces.
- OT gear: Siemens RUGGEDCOM APE1808. Schneider Security Expert (fix 1.48.4.0), Control Engineering, LINEoptimize. B&R APROL. ABB MES.
- Name: Researcher name. PHP does not use it.
- Tracked: #PHP2Shell posts on X, every 15 min.
- Sources: php.net · GHSA 109618 · GHSA 109619 · NVD 109618 · NVD 109619
Recommendations
- Patch now: Every runtime: FPM, mod_php, CLI, containers. No full mitigation exists.
- Packages: Fixed: Debian 12/13, Ubuntu, RHEL 8/9/10, Remi, Docker. Not yet: RHEL 9 php:8.4.
- PAN-OS: Hotfixes out, some due 29-30 Oct. Management access from trusted IPs only.
- Restart: PHP-FPM and Apache. Rebuild images with docker build --pull.
- PHP 8.1 and older: Vendor backport, or source branches 7.4, 8.0, 8.1.
- Interim, 109619 + 115560: session.upload_progress.enabled=0; on 8.5 also fatal_error_backtraces=0. In php.ini or the FPM pool, not .user.ini. Restart workers.
- Interim, 109618: memory_limit=-1 via php_admin_value, plus a cgroup memory limit per worker. No RLIMIT_AS or RLIMIT_DATA.
- Edge: Low post_max_size. Cap request size, multipart parts and headers. Block multipart if unused.
- Hunt: PHP workers that start shells or downloaders. Fatal errors in PHP logs (GHSA). A clean log is not proof.
- Detect: ET Open php2shell rules, CISA SIGMA rule, GreyNoise tags. The Nuclei check is intrusive.
- PoCs: Hundreds public, very few work (VulnCheck). Can be malware. Lab only.
- Share IOCs: Post on X with #PHP2Shell. In the feed within 15 min.
Advice changes as vendors publish. Check the linked sources before you act.
Recent IOCs tagged #PHP2Shell
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/php2shell.
| Date | Type | Value | Source |
|---|---|---|---|
| sha256 | |||
| url | |||
| ip | |||
| ip | |||
| url | |||
| url | |||
| ip | |||
| ip | |||
| ip | |||
| url |
Related tags
Frequently asked questions
What is PHP2Shell?
The researcher name for CVE-2026-109618 and CVE-2026-109619: two critical PHP flaws that allow unauthenticated RCE. PHP fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA added both to KEV on 26 October.
How do I protect my PHP servers from PHP2Shell?
Update PHP, restart every worker and rebuild container images. No full mitigation exists. Interim settings only reduce exposure.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this PHP2Shell subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
PHP2Shell IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.