Incident brief

PHP2Shell: investigate from October 17

AWS observed exploitation attempts before disclosure. Patch exposed PHP servers and investigate the activity that preceded the update.

Attempts observedFurther action neededCVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560

Disclosed Oct 21, 2026Updated Oct 23, 2026Sources checked Oct 23, 2026 UTC

Vendor: PHP
Exposure: No login required
Vendor severity: See original advisory

What happened

AWS dates the earliest observed attempt to October 17. Its report does not establish whether those attempts succeeded against real systems. A patched server still needs a review of earlier activity. Record gaps in telemetry.

The versions below fix the original two CVEs. PHP’s October 23 follow up, CVE-2026-115560, concerns an unusual session configuration and has a separate fix pending. Follow the vendor’s upload progress mitigation guidance while that fix is pending.

Affected systems and fixes

Product	Affected	Fixed release / action
PHP 8.5	Before 8.5.12	8.5.12
PHP 8.4	Before 8.4.27	8.4.27
PHP 8.3	Before 8.3.36	8.3.36
PHP 8.2	Before 8.2.35	8.2.35

Confirm the running version against the vendor advisory, including any distribution backports.

CISA exploitation evidence

Catalog 2026.10.23 · Checked Oct 24, 2026 UTC

No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.

PHP

Response checklist

0 of 3 complete

Identify exposed PHPCompare the deployed PHP version with the fixed releases. Include web applications, containers and servers managed by a hosting provider.Apply the vendor guidanceInstall the applicable fixed release and check PHP’s separate session upload progress follow up. Confirm the version actually serving requests.Investigate earlier activityPreserve and review host activity from at least October 17, including credentials accessible to the PHP process. Record any gaps in the logs.

Sources

Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.

PHP critical security advisoryPHP · vendor · Checked Oct 23, 2026 UTC
PHP2Shell observations in MadPotAWS · vendor · Checked Oct 23, 2026 UTC
Session upload progress follow upPHP · vendor · Checked Oct 23, 2026 UTC

Editorial record2 entries

Oct 23, 2026 UTCAct now: public exploits and observed attempts against web infrastructure. Attempts are not labeled confirmed compromise.

Oct 23, 2026 UTCClarified that the original fixes do not close the separate October 23 session issue; further vendor action remains necessary.

Oktsec Assessment

Choose what to review

Exposure check Patch verification AI agent review

Radar email

Get incident alerts and briefings

Act now incidents and team briefings, with sources and recommended actions.

Checking availability…