php2shell: Are your systems exposed to this 9.2 CVSS flaw?

On August 1, 2026, security researchers at Calif and Wiz, working alongside OpenAI and Quarkslab, identified the core weaknesses using AI models. The situation escalated rapidly in the private sector before public awareness caught up. By October 17, Amazon Threat Intelligence detected active exploitation attempts in its telemetry, a full four days before the intended coordinated disclosure. Once vulnerability details and CVE identifiers leaked online on October 20, PHP maintainers were forced to accelerate their emergency patch releases to stem the bleeding.

The two primary vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both carry a severe CVSS v4.0 score of 9.2. These memory corruption flaws allow attackers to execute arbitrary code on affected systems without requiring any prior authentication. Despite the PHP Project officially publishing patched versions (8.2.35, 8.3.36, 8.4.27, and 8.5.12) on October 21, independent telemetry indicates that over 32 million unpatched PHP services remain exposed globally. This sheer volume of unpatched endpoints underscores the severity of this specific phpvulnerability across enterprise environments, where security experts have already captured real-world attack trajectories using honeypot systems.

How HTTP2Shell compounds the php2shell risk

The threat landscape is further complicated by a related flaw known as HTTP2Shell (CVE-2026-111497). This out-of-bounds write vulnerability originates in Google's open-source Brotli decoder. When a system processes specially crafted malicious compressed streams, it triggers memory corruption that attackers leverage for privilege escalation or remote code execution. Originally affecting Node.js and Python, the blast radius has expanded over recent weeks to include .NET and PHP Windows distributions.

Microsoft responded by issuing emergency updates for .NET versions 8.0 through 11, noting an especially high risk for applications operating with the HTTP auto-decompression feature enabled. Simultaneously, PHP maintainers re-released their 8.2 to 8.5 Windows binaries with a "-1" suffix to integrate the securely patched Brotli components.

Institutional response and mitigation

The institutional fallout from these dual vulnerabilities prompted immediate action across global security organizations. Sophos temporarily took its MyUTM licensing portal offline on October 21 to safely apply security updates for the affected PHP software, while the QNAP Product Security Incident Response Team launched a comprehensive cross-functional review across its products and cloud services. On October 22, the National Computer Emergency Response Team of the Philippines (CERT-PH), operating under the Department of Information and Communications Technology, issued an official advisory. CERT-PH directed Philippine government agencies, critical information infrastructure operators, website administrators, and hosting providers to immediately inventory their PHP environments and apply the emergency patches before threat actors could capitalize on the unpatched systems.