Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure

On Tuesday, October 20, threat actors gained advance visibility into two critical PHP vulnerabilities after details leaked ahead of the planned disclosure, accelerating the race between defenders and attackers. The flaws are tracked as Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. Both carry a 9.2 rating on the Common Vulnerability Scoring System (CVSS) version 4.0 scale. For both vulnerabilities, Arctic Wolf’s Aurora® Agentic SOC helps organizations rapidly identify affected assets, correlate exploitation signals across the environment, and accelerate investigation and response before attackers can establish persistence.

An unauthenticated attacker can use either flaw to run code on a vulnerable server. On Wednesday, October 21, the PHP project released patched versions. PHP2Shell shows how AI is changing the threat landscape. Attackers can now find and weaponize old flaws in widely used technology faster than ever before. Arctic Wolf recommends treating every PHP installation that serves web requests as at-risk presently. Internet-facing Linux web servers without endpoint monitoring carry the highest risk of quiet compromise.

Patching remains the recommended remediation. Security teams should assess exposure immediately, identify likely attack paths, and segment critical systems to limit an attacker’s ability to move through the environment. If attackers exploit PHP2Shell, Aurora Agentic SOC is designed to detect the activity that follows, including webshell deployment, unauthorized command execution, persistence attempts, and lateral movement, enabling rapid investigation and response before attacks can escalate.

Overview and Impact

All PHP installations that serve web requests are at risk. That includes PHP-FPM (FastCGI Process Manager), Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP rates the risk highest for mod_php. In PHP’s demonstrated exploit, an unauthenticated request triggers the attack before any application code runs.

PHP runs WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, and control panels like cPanel and Plesk. Many vendor applications bundle PHP without saying so, which makes the affected assets hard to find. Bundled standalone binaries such as php.exe and php-cgi.exe on Windows are easy to miss.

Understanding the Root Cause

CVE-2026-109618 is an out-of-memory handling flaw. PHP can stop while internal request data is only partly set up. Request cleanup may then treat that invalid data as valid.

CVE-2026-109619 is a stale state flaw. Request-owned internal state can survive after its memory is freed. A later request on the same worker may use that stale state before normal setup resets it. The PHP session upload progress feature is one confirmed path to this flaw, and it’s enabled by default.

Guidance for Arctic Wolf Customers

1. Inventory every system that runs PHP. Include package-based installs, containers, appliances, and hosting panels. Include vendor software that bundles PHP. Include continuous integration and continuous delivery (CI/CD) images.
2. Identify the PHP branch and package source on each system.
3. Update to the patched version or confirm your vendor has backported both fixes. Patch internet-facing systems first.
4. Restart every affected service. That covers PHP-FPM, Apache, NGINX upstream pools, application workers, and containers.
5. Rebuild container images from patched upstream bases. Patching only the running containers leaves the image exposed.
6. Move end-of-life PHP to a supported branch.
7. Record the patched version, vendor advisory, restart time, and validation evidence for each host or image. If a workload can’t be patched right away, document compensating controls and an approved exception with an expiry date.

Patched versions

The PHP project no longer releases updates for 8.1 or older. Some distributions and long-term support (LTS) vendors provide backported fixes, so check with your vendor.

Audit commands

Use these commands to find PHP packages and confirm that your vendor backported both fixes.

Use stopgaps to reduce exposure while you patch

Configuration changes such as memory_limit or session.upload_progress.enabled are not remediation. PHP states that only an update is a complete solution. The required fix is a patched PHP runtime or a vendor package that explicitly backports both fixes.

If you can’t update right away, PHP lists measures that reduce exposure to specific attack paths. These measures do not make an installation safe.

For CVE-2026-109618

• Set memory_limit=-1 in a way applications can’t override, such as php_admin_value in the FPM pool or Apache configuration.
• Set a low post_max_size. PHP suggests 8M for applications without uploads and 32M for those with uploads. Keep upload_max_filesize below it.
• Enforce request size, field count, and header limits at the web server or proxy.
• Skip RLIMIT_AS and RLIMIT_DATA because they can trigger the vulnerable allocation failure.

For CVE-2026-109619

• Set session.upload_progress.enabled=0 in php.ini or in an FPM pool or server configuration that applies before request parsing. Then restart every worker. This blocks the confirmed session paths but not other variants.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
• Fix attacker-reachable fatal errors and execution timeouts.

How Arctic Wolf Labs turns telemetry into outcomes

Arctic Wolf Labs is our threat intelligence and research team. Global SOC telemetry visibility drives a shared defense, while active network monitoring gives Labs an early warning system across our global customer base. Using telemetry from across the Arctic Wolf customer community, researchers identify spikes in scanning activity, analyze exploitation attempts, and uncover attacker payloads associated with PHP2Shell. We use those findings to develop and fine-tune detections to respond to malicious activity faster. This means customers gain coverage against PHP2Shell activity they may have not observed yet in their unique environment.

Labs researchers also replicate attacker techniques against PHP2Shell vulnerabilities in controlled environments. Arctic Wolf Labs leverages resulting artifacts from these simulations, as well as observed exploit techniques, attacker tradecraft, and emerging indicators of attack/compromise (IOA/IOC), to develop new detections, threat hunt queries, and inform customer remediation guidance

As threat behavior evolves, we continuously apply the latest intelligence across customer environments. Arctic Wolf Labs’ initial investigation has identified numerous scanning efforts as well as malicious exploitation attempts, including passing wget requests to retrieve both ELF and Golang binaries associated with commodity malware.

How the Aurora Superintelligence Platform keeps customers protected

The Aurora Superintelligence Platform helps organizations reduce PHP2Shell risk before and after exploitation. Aurora Vulnerability Management identifies and prioritizes affected assets using live exploit activity and threat intelligence, helping security teams focus remediation efforts where risk is highest.

The Aurora Agentic SOC monitors the behaviors attackers rely on after exploitation, including webshell deployment, suspicious processes spawned by PHP or web servers, malicious command execution, persistence activity, and lateral movement.

Together, these capabilities help organizations quickly identify exposed systems, prioritize remediation, detect malicious activity, investigate potential compromise, and contain threats while vulnerable systems are being patched. As the threat evolves, Arctic Wolf continuously incorporates new intelligence across the platform to strengthen proactive cyber risk remediation and detection and response capabilities for all customers.