Skip to main content

2026 - October PHP2SHELL

Tyler
  • Updated

Is this being exploited in the wild?

There are clear indications from Cloudflare and additional reports from the field that exploitation is occurring in the wild. Multiple public proof-of-concept (PoC) exploits are available. With patch availability, widespread exploitation of unpatched systems is expected to accelerate quickly.

What versions of PHP does this affect?

Affected Versions:

  • PHP 8.2 
  • PHP 8.3 
  • PHP 8.4 
  • PHP 8.5 

Patched Versions:

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

Official security patches are now available directly from PHP for versions 8.2 and above. Note that older, end-of-life versions of PHP are reportedly vulnerable as well, but are no longer officially supported or covered by security advisories.

Patches are already publicly available - Please refer to the official PHP advisory page https://www.php.net/downloads.php?source=Y


Am I Affected?

You may be affected if you operate PHP-based websites, applications, hosting platforms, control panels, vendor appliances, or software that bundles PHP. To assess your exposure:

  1. Inventory all PHP installations, including systems managed by third-party vendors.
  2. Identify the PHP version and determine whether the system is internet-facing.
  3. Prioritize systems running older or end-of-life PHP branches, which may not receive an official fix.
  4. Monitor official PHP and operating-system vendor advisories for confirmed fixed versions.

What Is Huntress Doing?

  • Huntress is assessing PHP exposure across partner environments and prioritizing internet-facing systems for monitoring.

Recommended Next Steps

  1. Inventory and identify every PHP deployment in your environment.
  2. Prioritize internet-facing systems for patching.
  3. Upgrade or isolate end-of-life PHP systems that cannot receive a security update.
    1. Fixes are already publicly available - please review RCE via OOM corruption · Advisory - PHP & https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp for full details. 
  4. Review web-server and PHP logs for unusual activity, such as unexpected command execution  by PHP worker processes.
  5. If suspicious activity is identified, isolate the affected system, preserve relevant logs, and contact your security provider.
  6. Avoid unofficial emergency patch scripts. Use updates from PHP, your operating-system vendor, or your software provider.

How to Get Help

For the latest technical details and detection guidance, see the Huntress blog: php2shell: Leaked Critical PHP Vulnerabilities. You can also review the official PHP security release information.