PHP2Shell: Critical PHP Vulnerabilities Targeted Before Public Disclosure
October 22, 2026 | Britec Threat Board
Hackers were targeting critical PHP vulnerabilities before the public even knew they existed.
Amazon’s Threat Intelligence team detected an attempt to exploit PHP2Shell on October 17, 2026, four days before the vulnerabilities were publicly disclosed. Additional exploit attempts followed the release of emergency security patches on October 21.
What Is PHP2Shell?
PHP2Shell refers to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS 4.0 severity score of 9.2.
These flaws affect PHP, a programming language used by many websites and web applications, including those built with WordPress and Magento.
Successful exploitation could allow attackers to:
- Execute malicious code without authentication.
- Access sensitive business or customer information.
- Compromise website servers and connected systems.
- Disrupt business operations.
Unlike vulnerabilities in individual plugins, PHP2Shell affects the underlying PHP software itself.
Why Should Businesses Care?
The most concerning detail is how quickly attackers began exploiting these weaknesses.
Amazon identified suspicious activity before public disclosure, and additional attempts appeared within hours of the emergency updates.
For businesses relying on outdated website infrastructure, this creates a serious security risk.
The Canadian Centre for Cyber Security has urged organizations to update affected systems immediately.
What Can Businesses Do?
- Update PHP immediately. Install the fixed versions: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, as appropriate.
- Check your website infrastructure. Identify vulnerable PHP installations, including third-party applications.
- Monitor suspicious activity. Review server logs and investigate unexpected processes, file changes or connections, including activity dating back to October 17.
- Review your security measures. Ensure patch management, monitoring and incident response procedures are in place.
How Britec Helps
Cyber threats don’t wait for businesses to catch up.
Britec helps organizations strengthen their cybersecurity posture through proactive IT management, monitoring and security solutions.
Concerned about your business’s security? Talk to a Britec Expert.
Sources: Amazon Threat Intelligence | PHP Foundation | Canadian Centre for Cyber Security
