# PHP2Shell exploits surge as attacks began before public disclosure

> **Key takeaway:** Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 are seeing millions of exploitation attempts, with some activity detected days before patches were released.

**Published:** 2026-10-22T12:15:00+00:00 
**Source:** The Register 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/php2shell-exploits-surge-as-attacks-began-before-public-disc.html 

## Summary
Attackers are aggressively targeting the PHP runtime using the PHP2Shell vulnerabilities, which carry a critical 9.2 severity rating. Cloudflare reports exploitation attempts have climbed into the millions, while Amazon detected activity as early as October 17, four days before the official disclosure. The flaws affect PHP's memory handling, potentially allowing unauthenticated remote code execution.

## Technical details of PHP2Shell
- Affects **CVE-2026-109618** and **CVE-2026-109619**.
- Critical severity rating of **9.2**.
- Targets **PHP memory handling**, enabling unauthenticated remote code execution.
- Many attacks exploit the **PHP session upload-progress path**.
- Attackers are actively modifying payloads to bypass **WAF** protections.

## Why it matters
Because these vulnerabilities affect the PHP runtime itself rather than specific plugins, a massive number of websites and content management systems are at risk.