PHP2Shell: How CyberMindr Helped Companies Stay Ahead of Attackers 

Cybermindr Insights

Published on: October 23, 2026

Last Updated: October 23, 2026

How many internet-facing servers in your organisation are running PHP right now? 

For most security teams, that question became urgent on October 20, when two critical PHP vulnerabilities leaked online before a fix was available. Since then, CyberMindr has scanned more than 40,000 domains and identified over 1,000 internet-facing assets running vulnerable PHP versions. Here is what we learned, and how we helped our customers respond. 

What Happened

On October 20, 2026, details of two critical PHP vulnerabilities leaked ahead of coordinated disclosure. Tracked together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), they sit in PHP's session upload progress feature, which has shipped enabled by default since PHP 5.4. 

That default is what makes PHP2Shell so wide-reaching. PHP runs around 77% of all public websites, including WordPress, Laravel and Symfony sites, online stores and countless custom applications. Every one of them running an affected version was in scope from day one. 

Both flaws carry a CVSS v4.0 score of 9.2, though the score matters less than how easily attackers can reach them. A fully automated, one-click proof-of-concept was published and confirmed working against PHP 8.4.26 and 8.2.34, the latest builds available at the time. watchTowr independently reproduced it.
The PHP team released emergency fixes on October 21, a day earlier than planned, because the details were already public. 

How the attack works 

An attacker needs only network access to the web server. No login, no plugin and no special configuration are required. 
The public exploit takes four staged HTTP requests. The first resets the server's memory to a predictable state. The next two leak memory addresses through the server's own Set-Cookie responses, which lets the attacker defeat ASLR, a core memory protection. The final request plants a forged data structure that tricks PHP into running a system command of the attacker's choosing. 

This is why existing security controls struggle: 

• The flaw triggers while PHP processes the incoming request, before the website's own code and security checks run. A well-secured custom application is as exposed as a basic WordPress site. 
• Every stage travels over standard HTTP or HTTPS, so it looks like ordinary web traffic to a firewall. 
• The flaw was unknown until October 20, so no security tool had a defence ready for it.

Why patching alone is not enough 

FApplying the patch takes minutes. Three things make the full response much harder. 
End-of-life versions will never be fixed. PHP 8.1, 8.0, 7.x and 5.x receive no official patch. Turning off session upload progress (session.upload_progress.enabled = Off) is a stopgap.The lasting fix is an upgrade, or taking the server offline. 

Attackers may already be inside. Web shells planted before patching survive the update and keep giving attackers access. Configuration files such as wp-config.php and .env often hold database passwords, API keys and cloud credentials in plain text. 

Few companies have a complete list. Old campaign sites, regional portals, acquired brands and staging environments often sit outside the main asset inventory. Attackers start scanning for PHP version headers within hours of a disclosure, and they scan everything that is online, whether or not your team is tracking it.  

How CyberMindr Flagged the Exposure Within 24 Hours 

Most security tools work from inside the network, so they can only check systems a company already knows about. CyberMindr works from the outside, the way an attacker does, mapping every internet-facing subdomain, IP and URL that serves PHP. 

How we handled PHP2Shell: 

• Detection: We scanned 40,000+ domains on demand after the disclosure, with no waiting for the next scheduled assessment. Customers did not need to install anything or give us internal access. 

• Identification: We fingerprinted the PHP version on every asset and matched it against the affected range. The scan found 1,000+ internet-facing assets running vulnerable versions, including assets missing from customers' own inventories. 

• Notification: Affected customers were alerted within 24 hours, with each asset ranked by criticality. End-of-life versions were flagged separately, because they need a different response. 

• Remediation guidance: Every alert came with clear fix steps, updated within an hour of each new development.

Alongside these findings, CyberMindr also surfaced the PHP upload endpoints the exploit targets, servers publicly revealing their PHP version in headers, and signs of web shells or unusual files on web roots. 

What to do once you have your list from CyberMindr 

Once CyberMindr flags your exposure, this is what your team gets, and what happens next. 

• Get your asset list: Every affected asset in one place, down to the exact subdomain, endpoint and PHP version, ranked by criticality. This tells you exactly where to start. 

• Get remediation guidance: Fix steps for each asset, updated within one hour of any new development. This covers which patched version to move to (8.5.12, 8.4.27, 8.3.36 or 8.2.35) and what to do with end-of-life servers. 

• Check for compromise: Review any flagged web shells or unusual files, and rotate credentials stored in configuration files on servers that stayed exposed. 

• Bring your own LLM: Connect CyberMindr to your team's AI assistant and ask about your findings in plain language, for example which servers still run an old PHP version. 

• Apply the fixes and confirm: Your team applies the updates, and CyberMindr re-scans from the internet to confirm each asset has moved to a fixed release. Internal patch records show that a fix was applied. An external re-scan shows that attackers can no longer reach the old version.

Be ready for the next one 

PHP2Shell will not be the last critical flaw of its kind, and end-of-life servers stay exposed to every future vulnerability in their branch. A one-time audit only shows where you stood on the day it ran.