PHP2Shell Fixes Skip 758,000 IP Addresses Still Running Retired PHP Branches

PHP fixed two critical flaws on Oct. 21 in branches 8.2 through 8.5 only, while VirusTotal data counts about 758,000 internet-facing IP addresses on older versions that received no patch.

The flaws, CVE-2026-109618 and CVE-2026-109619 (CVE is a tracking number for one specific flaw), are collectively called PHP2Shell. The PHP Foundation said in its release post that on Apache with mod_php an unauthenticated request can trigger the first one before any application code runs, and that remote code execution was demonstrated with default settings. Both carry a CVSS score (a 0-to-10 severity scale) of 9.2.

What CVE-2026-109618 and CVE-2026-109619 let an attacker do

CVE-2026-109618 is an out-of-memory corruption bug. If a request hits PHP's memory_limit at the wrong moment, PHP can keep partially initialised internal data and later treat it as valid. CVE-2026-109619 is a stale-state bug: a fatal error at the wrong point can leave internal state pointing at memory from a previous request, which a later request on the same worker then uses after it was freed.

Wiz Research demonstrated unauthenticated code execution on the latest container images of WordPress, Drupal and Joomla. Its post says exploitation does not depend on a flaw in the application's code.

The score overstates how easily a generic attacker succeeds. Wiz wrote that exploitation took "repeated testing and debugging" and that differences in PHP version, configuration and application behaviour can break an exploit. The score understates the reach: Wiz wrote that "Every PHP version released in the last decade is affected by at least one of these vulnerabilities."

Who is left on a branch with no fix

The fixed releases are listed below. Recorded Future's Insikt Group said unsupported branches are not covered by these fixes.

Branch	Fixed version	Status
PHP 8.5	8.5.12	Patched Oct. 21
PHP 8.4	8.4.27	Patched Oct. 21
PHP 8.3	8.3.36	Patched Oct. 21
PHP 8.2	8.2.35	Patched Oct. 21
PHP 5.4 to 8.1	None	Unsupported

Recorded Future cited two scans. VirusTotal sees about 5.1 million IP addresses running PHP, of which about 1.1 million disclose a version. Of those, about 758,000 run end-of-life branches (5.4 to 8.1) against about 272,000 on supported ones. Modat counted 4,384,302 PHP services on 1,886,612 hosts and found about 79 percent of services with a readable version on an unsupported branch. Neither scan counts confirmed vulnerable hosts.

1. End-of-life branches (5.4 to 8.1)758K IPs
2. Supported branches272K IPs

Source: VirusTotal figures as cited by Recorded Future Insikt Group, accessed 2026-11-04

The timeline from July 30 to Oct. 21

The Foundation's post dates the disclosure as follows.

• July 30: Calif began a PHP audit under the Patch the Planet program.
• Aug. 11: Calif reported unconditional remote code execution with the same root cause; OpenAI independently reported it.
• Aug. 24: Wiz reported its findings.
• Sept. 18: OpenAI reported further attack vectors.
• Oct. 20: The CVE IDs leaked at about 15:00 UTC with a wrong CVSS score of 10.0, and Calif published a video of its proof of concept by mistake at about 20:00 UTC.
• Oct. 21: Chainguard published images containing the fix at 07:41 UTC, more than six hours before the 14:00 UTC coordinated release.

IEEE Spectrum, in a Nov. 2 report, said a Calif researcher aided by AI tools found the exploit path in about two weeks of audit work. Matthew Green, an associate professor of computer science at the Johns Hopkins University Information Security Institute, said in that report: "Nobody's going to fix this problem until something really bad happens." The Terminal has also covered Hinton's reaction to the Hugging Face intrusion and Chrome 156's credit lines.

Exploitation: the sources disagree

The Foundation said it "did not identify any functional exploits" at release, though proof-of-concept circulation increased on Oct. 21. Recorded Future said Patchstack reported "multiple active exploitation incidents" from hosting partners by 07:34 UTC the same day, and Insikt said the reporting "does not establish the full extent of successful exploitation or confirmed compromises."

Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and move any host on 8.1 or older to a supported branch. Insikt advises reviewing web and application logs from Oct. 20 and rotating credentials on any system showing compromise. Wiz lists repeated HTTP 500 responses and oversized PHPSESSID cookies as signs to look for.