PHP2Shell: unauthenticated PHP RCE, now mass-exploited — patch now
Two CVSS 9.2 engine-level flaws mean even clean apps are exposed; one request runs code, attempts hit millions, and AI built the exploit in hours.
Copy markdown
One request, code execution — and it's in the engine, not your app
CVE-2026-109618 and CVE-2026-109619 are both CVSS 9.2 unauthenticated RCE: on Apache mod_php a single crafted request can run code before your app ever loads, and because the bugs live in the PHP engine (reaching back to PHP 5.4 in 2012), a spotless WordPress, Laravel or Drupal site is still exposed. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — patch and restart every worker. 8.1 and older are end-of-life, with source backports only for 7.4/8.0/8.1.
Disclosure to millions of hits in under a day
Cloudflare logged tens of thousands of exploit attempts 45 minutes after the Oct 21 disclosure and millions by early Oct 22; Censys now assesses 34.4M+ PHP services as vulnerable. The payload is "Potassium," a Mirai fork built for DDoS floods. The reprieve: as of Oct 23 no confirmed RCE or dropped web shell had been seen in the wild — most traffic is scanning and clumsy payloads — so patching today still gets you ahead of it.
AI turned a 2012 bug into a working exploit in hours
The builder-relevant twist: a 2024 audit had flagged CVE-2026-109618 but found no way to exploit it — this month researchers used AI tooling to weaponize it fast. VulnCheck built an ASLR bypass that lands RCE on x86-64 even with PHP's recommended production error settings, and SOCRadar found a "one-click" exploit kit on an attacker's server. Offense now moves at model speed; your patch window is hours, not weeks.
Can't patch this minute? Stopgaps, then rotate secrets
These cut exposure but don't make you safe. Set session.upload_progress.enabled=0 (in php.ini or the FPM pool, not ini_set) to close CVE-2026-109619's confirmed path; cap request size (post_max_size 8–32M, lower upload_max_filesize); on PHP-FPM consider pm.max_requests=1. Then rotate every credential the app can reach — DB passwords, API keys — because these flaws also leak PHP worker memory. CISA and the UK's NCSC have both pushed advisories, NCSC sending roughly 50,000 warnings.
Weekend build: train an agent on what it actually did
Unrelated but worth a tab: Microsoft open-sourced ThinkingBox (MIT) — a sandbox plus a 507-task benchmark that grades agents on the database state they leave behind, not on what they claim, then reuses those executable checks as RL rewards. In their run, GRPO fine-tuning took a Qwen3.8-27B from 7.5% to 21.1% of tasks passing 20 of 20, and cut the cost per dependable task from $24 to $8. Code and benchmark data are on GitHub and Hugging Face.