Two critical PHP vulnerabilities, tracked together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), were under attack before many servers could be patched.

What's known so far:

Impact: the flaws sit in how PHP handles certain memory errors during server requests and allow remote code execution without credentials.

Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The UK's NCSC and the US NSA advised shutting down servers that can't be updated right away.

Early exploitation: AWS says one actor started hitting its honeypots on October 17, four days before technical details went public; proof-of-concept exploits surfaced in the hours before disclosure.

Disclosure dispute: the PHP Foundation says Chainguard broke the embargo on October 21 at 07:41 UTC by publishing patched images more than six hours early; Chainguard's CEO says it acted on evidence of active exploitation.

The practical problem, as Sophos CTU puts it, isn't just installing the fix but finding every PHP instance: it often runs…