PHP2Shell

What happened

Two chained bugs in PHP's multipart form parser let an unauthenticated request reach remote code execution on default configurations. Governments took sites offline rather than patch in public.

Timeline

1. 21 Oct 2026 · 06:10 UTC

   Disclosure

   PHP publishes fixed builds: 8.2.35, 8.3.36, 8.4.27, 8.5.12.

2. 21 Oct 2026 · 11:40 UTC

   Mass scanning

   Honeypots see exploitation attempts against multipart endpoints within five hours.

3. 22 Oct 2026 · 02:00 UTC

   Governments offline

   Several public-sector sites are pulled down instead of emergency-patched.

Indicators

Published indicators age quickly. Treat these as research artefacts, not a blocking list.

Sources

• NVD — CVE-2026-109618nvd.nist.gov
• PHP security advisorieswww.php.net