PHP2Shell Set Off Alarms Worldwide. How to Stay Protected Until You Patch.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are being actively exploited worldwide, allowing attackers to execute code without authentication on unpatched servers.
The cause was PHP2Shell: two critical flaws in PHP itself that allow attackers to execute code on unpatched PHP servers with no login required. Both vulnerabilities score 9.2 on CVSS v4.0 and affect popular e-commerce platforms including Magento, Shopware, and WooCommerce even when their own code remains clean.
AI Accelerates Exploitation
PHP2Shell demonstrates how artificial intelligence has dramatically reduced the time between vulnerability discovery and exploitation. A PHP developer identified potential issues during a 2024 audit, but the fix stalled until AI researchers found exploitable paths within weeks in August. By October 17, Amazon Threat Intelligence's MadPot telemetry recorded exploit attempts, just four days before public disclosure.
A weakness once too hard or too costly to exploit can be weaponized much faster when AI lowers the cost of discovery and exploit development.
Exploitation Patterns Detected
Attackers must send specifically crafted requests to exploit these flaws, creating distinct network patterns. For CVE-2026-109618, signatures include abnormal file-upload requests with no declared size or excessive empty fields. CVE-2026-109619 exploits code hidden in filenames and unexpected session data handling. On October 22, Proofpoint published eight network signatures to detect and block these attempts.
Patch Deployment Challenges
Remediation requires updating servers, rebuilding container images, and coordinating with hosting providers. End-of-life PHP branches (7.4 through 8.1) only receive source backports, leaving teams dependent on vendors for patched packages. The median time to fully remediate vulnerabilities is 43 days, according to Verizon's 2026 DBIR, leaving systems exposed for weeks.
As of October 23, 2026, neither PHP2Shell CVE appears in CISA's Known Exploited Vulnerabilities catalog, causing organizations relying on this list to miss the threat. When patching couldn't be completed in time, some teams resorted to taking websites offline entirely.
Protection During Patching
Proofpoint Active Exploits Protection offers a solution by providing early intelligence on exploited vulnerabilities and blocking attacks before they execute. The system leverages first-party telemetry from Proofpoint's global network, including visibility into 2.37 trillion emails annually and analysis of 600,000 malware samples daily. For PHP2Shell, Proofpoint's eight detection signatures are already integrated into its protection ruleset.
The Active Exploits Protection API allows security teams to integrate this intelligence with existing SIEM, TIP, and vulnerability management platforms, providing clear visibility into exploitation methods and protection measures while patching is underway.
Related
