Php2shell Bugs Exploited as New Flaw Gets No Emergency Fix
WHO:
The Hacker News - OpenAI researchers found the Brotli flaw, and Google fixed it in Brotli versions 1.2.1, 1.1.1, and 1.0.10.
BleepingComputer - Adel Karimi, detection and response lead at Perplexity, identified evidence of PHP2Shell exploitation through honeypots.
BleepingComputer - Expel threat researcher Marcus Hutchins confirmed Karimi’s findings and described them as “by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far.”
BleepingComputer - The PHP security team patched the PHP2Shell vulnerabilities and issued mitigation advice for a separate RCE vulnerability.
TechRadar - Experts reported another PHP2Shell bug that can trigger remote code execution under conditions described as “unlikely.”
WHAT:
The Hacker News - PHP rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a Brotli-library flaw that can corrupt memory and potentially allow code execution.
The Hacker News - The rebuilt packages are 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; they include Brotli 1.2.1 and retain the PHP2Shell fixes.
The Hacker News - The flaw can be reached through PHP’s cURL extension when automatic HTTP-response decompression is enabled. `CURLOPT_ENCODING` enables it; an empty value accepts every format cURL supports.
The Hacker News - Guzzle sets an empty encoding value by default for cURL requests in releases 7.16.1 and 8.3.1.
The Hacker News - Google rated the flaw 9.2 (Critical) on CVSS 4.0; Red Hat rated it 8.1 (Important) on CVSS 3.1.
The Hacker News - PHP’s notice offers no workaround for systems that cannot update; OpenAI advised disabling automatic Brotli decompression until updating and warned that removing `br` from the `Accept-Encoding` header alone does not prevent a server from sending Brotli data.
BleepingComputer - Two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, were successfully exploited in the wild.
BleepingComputer - The confirmed exploitation targeted an Apache mod_php installation running PHP 8.4.26.
BleepingComputer - Karimi said the response included an 800 KiB decoded cookie dump and that a function address derived from it using offsets from the public exploit appeared in the subsequent execution payload.
BleepingComputer - Karimi said the client acknowledged the full response and the shell command ran about 1.6 milliseconds after the execution request’s final captured byte.
BleepingComputer - A separate RCE vulnerability, CVE-2026-115560, has no patch; the PHP team advised administrators to set `session.upload_progress.enabled=0` to block potential attacks.
BleepingComputer - VirusTotal estimates more than 5.1 million PHP hosts are exposed online, with roughly 3.8 million having at least one port open to attacks. PHP is used by roughly 70% of websites on the Internet.
TechRadar - The newly reported bug does not have an emergency patch, according to the article’s headline.
WHERE:
BleepingComputer - The confirmed exploitation was against an Apache mod_php installation; the article does not identify its physical location.
BleepingComputer - Amazon Threat Intelligence researchers observed attackers targeting PHP2Shell vulnerabilities; the article does not specify where.
WHEN:
BleepingComputer - The PHP security team patched the PHP2Shell flaws on Wednesday, October 21.
BleepingComputer - The PHP team shared mitigation measures for CVE-2026-115560 on Friday.
BleepingComputer - Amazon Threat Intelligence observed targeting four days before the PHP2Shell security patches were released.
WHY:
BleepingComputer - CVE-2026-115560 can reportedly be exploited only against systems with “an unusual combination of configuration and application code.”
HOW:
The Hacker News - An attack would involve a crafted compressed response from a server contacted by the PHP application.
BleepingComputer - Karimi’s honeypots captured the exploitation evidence, including the decoded cookie dump and execution payload.
BleepingComputer - Before disclosure, cybersecurity firms including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack detected attempts but flagged them as unsuccessful. Dataminr’s TRACE team said earlier activity was limited to scanning, fingerprinting, and non-working exploits, with no known compromises.
(UPDATED October 27, 2026 02:14 UTC)
Researchers confirmed that attackers have exploited two critical PHP2Shell vulnerabilities in the wild, including against an Apache server running PHP 8.4.26; the PHP team has patched those flaws. A separate remote-code-execution vulnerability has no patch, and administrators are advised to disable PHP session upload progress to help block attacks. Separately, Google fixed a critical Brotli flaw in rebuilt Windows PHP packages, and OpenAI recommends disabling automatic Brotli decompression until systems are updated.
--
(UPDATED October 26, 2026 14:47 UTC)
Two critical PHP vulnerabilities known as PHP2Shell have been exploited in the wild, with honeypots capturing a successful attack against an Apache server running PHP 8.4.26. The PHP security team has patched those flaws, while a separate remote-code-execution vulnerability remains unpatched, and administrators are advised to disable session upload progress to reduce risk. Researchers also reported another PHP bug that could enable remote code execution under unlikely conditions, as millions of PHP hosts remain exposed online.