anything2shell

Check if your domain is exposed to PHP2Shell

Runs our passive, non-intrusive HTTP header & telemetry check on the main scanner.

PHP2Shell

CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVSS 9.2 Critical (v4, PHP) EPSS 99.99%
Boardroom Quick Reference

CIA Risk Posture & Executive Assurance

Active Mass Exploitation EPSS: 99.99% Scope: Public Web & Customer Data
Confidentiality
High Risk
Data Exposure & Secret Leakage

Live server memory, database passwords, API keys, and active user sessions can be extracted remotely without authentication.

Integrity
Critical Risk
System Control & Trust

Attackers can hijack the web runtime to execute arbitrary commands, alter site behavior, or plant persistent backdoors.

Availability
Elevated Risk
Service Uptime & Continuity

Automated mass scanning forces web workers out of memory, causing intermittent service degradation and web pool crashes.

Executive Decision Points Assurance vs. Activity — Key questions for your CISO / IT Lead
Are running web workers verified?

Updating packages without restarting worker pools leaves the threat live in memory, and a second related flaw requires disabling upload progress in configuration.

Have in-memory secrets been rotated?

Because attackers probed servers days before public disclosure, exposed systems must rotate database passwords and API keys. Patching alone does not revoke stolen credentials.

Technical Deep-Dive, IoCs & Remediation

PHP2Shell is a set of critical memory-safety vulnerabilities in the core PHP engine affecting roughly 70% of websites—including WordPress, Drupal, Joomla, and Magento—where a flaw in the underlying runtime exposes servers to memory disclosure and unauthenticated remote code execution even when application code is completely secure.

Disclosed on October 21 with emergency patches in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (The PHP Foundation ↗), CVE-2026-109618 and CVE-2026-109619 came under immediate mass scanning. Amazon honeypots logged pre-disclosure exploit attempts as early as October 17, and Cloudflare observed attack traffic surging from tens of thousands of requests within 45 minutes of disclosure to millions within 24 hours, including campaigns attempting to deploy Mirai botnet variants. At peak during the remediation scramble, Oh Dear telemetry ↗ recorded 18.8% of monitored PHP sites offline (vs. 0.9% baseline); while Sansec ↗ and The PHP Foundation noted that leaked public PoCs fail against default installs without target-specific conditions or a separate LFI, Apache mod_php remains highest risk.

Two days later on October 23, PHP warned of a separate, still-unpatched RCE risk (CVE-2026-115560) that is not fixed by the October 21 emergency releases (The Hacker News ↗). It affects setups where session.upload_progress.enabled is active (on by default) and session.serialize_handler is configured as php_binary or php_serialize before being switched at runtime to php via ini_set() prior to session_start(). Until a routine fix ships in the next release cycle, PHP advises setting session.upload_progress.enabled = 0.

Why it’s a risk

Unauthenticated attackers can send crafted HTTP requests that force PHP workers out of memory during session initialization (CVE-2026-109618). This leaks live server memory—such as database passwords, API keys, and session tokens—directly into outbound Set-Cookie: PHPSESSID response headers, and allows remote code execution by corrupting shared OPcache memory (CVE-2026-109619).

How to recognize it (Versions, Logs & IoCs)

  • Vulnerable versions: PHP 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and all end-of-life PHP 5.4–8.1 releases.
  • In your logs: Unusually long or binary URL-encoded Set-Cookie: PHPSESSID=... headers in outbound responses, bursts of multipart/form-data or PHP_SESSION_UPLOAD_PROGRESS POST requests followed by HTTP 500 errors, and repeated php-fpm worker restarts.
  • Threat Intelligence IoCs: Traffic from Google Threat Intelligence campaign GLOBAL.26.015 and threat actor UNC5638 (see IoC blocklist below).

How to mitigate it

  • Patch & restart workers: Upgrade PHP to a fixed release below and restart php-fpm or Apache so running worker processes load the patched binary.
  • Keep session upload progress disabled (unpatched CVE-2026-115560): Even after upgrading PHP, set session.upload_progress.enabled = 0 in php.ini until the next PHP release cycle to block the still-unpatched CVE-2026-115560 RCE vector (affecting apps with a non-default session.serialize_handler switching to "php" at runtime) as well as CVE-2026-109619, and block PHP_SESSION_UPLOAD_PROGRESS at your WAF.
  • Pre-patch runtime hardening (if unable to update immediately): Follow Google Cloud & Mandiant’s PHP runtime hardening guidance ↗ and Mattias Geniar’s tested server configs ↗ for compensating controls while scheduling your upgrade.
    Show php.ini & verify CLI Hide php.ini & verify CLI
    php.ini / www.conf 
    ; 1. Stop CVE-2026-109619 & CVE-2026-115560 Stale Pointer Producers
session.upload_progress.enabled = 0
fatal_error_backtraces = 0

; 2. Stop CVE-2026-109618 Multipart OOM Bailout
memory_limit = -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_nesting_level = 16
max_input_vars = 250
max_file_uploads = 10
max_multipart_body_parts = 100

; 3. Runtime Hygiene & Worker Reset (www.conf)
expose_php = Off
display_errors = Off
pm.max_requests = 1
    Verify mitigation (CLI & HTTP) 
    # 1. Confirm PHP-FPM / CLI flags are Off (restart workers, reload is not enough)
php-fpm -i | grep -E 'session.upload_progress.enabled|fatal_error_backtraces'
# 2. If blocking multipart at nginx/Apache/WAF, confirm HTTP 403
curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://example.com/
What does NOT work (Common Traps): Disabling session.upload_progress.enabled blocks CVE-2026-115560, but does not stop CVE-2026-109618/19 on its own—patching PHP is mandatory (Mattias Geniar ↗):
  • ini_set() / .user.ini run too late: Request startup & multipart parsing execute before them; set flags in php.ini or FPM php_admin_flag and restart workers (reload is not enough).
  • file_uploads = Off still parses multipart: Block Content-Type: multipart/* (case-insensitive) at nginx/Apache/WAF instead.
  • Per-request PHP_VALUE & RLIMIT_AS trigger bugs: Warnings from .htaccess / fastcgi_param PHP_VALUE can trigger CVE-2026-109619, and OS RLIMIT_AS/RLIMIT_DATA triggers CVE-2026-109618.
  • mod_php & handler disablement: Standard form POSTs also trigger CVE-2026-109618 on mod_php; never disable only the PHP handler (serves raw .php source & secrets as plain text).
PHP Branch Vulnerable Releases First Fixed Release Operational Note
PHP 8.5 < 8.5.12 8.5.12 Restart PHP-FPM / web workers after upgrading
PHP 8.4 < 8.4.27 8.4.27 Restart PHP-FPM / web workers after upgrading
PHP 8.3 < 8.3.36 8.3.36 Verify Linux distribution backports if using OS packages
PHP 8.2 < 8.2.35 8.2.35 Oldest upstream-supported branch receiving fixes
PHP 5.4 – 8.1 All EOL releases Distro backport only Place behind Cloudflare Access, Cloud IAP, or VPN

PHP2Shell Indicators of Compromise (IoC)

UNC5638 GTI GLOBAL.26.015 AWS MadPot Arctic Wolf

Verified PHP2Shell mass-scanning, exploitation, and Potassium Mirai C2 indicators — block at your firewall and hunt in your SIEM.

Indicators (IPv4 / Subnet / Domain / SHA-256) Campaign / Role Attribution & Observed Activity
116.98.243.14 (116.98.224.0/19) 176.236.127.109 176.236.127.37 (176.236.0.0/17) 49.87.220.67 (49.87.0.0/16)
OOM Recon & Probing Google Threat Intelligence GLOBAL.26.015 & UNC5638 — Early PHP2Shell mass scanning & OOM probing
103.216.220.92 31.223.184.166 37.19.200.5 134.209.159.64 103.114.163.188 95.217.98.37
Pre & Post-Disclosure Waves AWS Threat Intelligence (MadPot) — Pre-disclosure recon & post-disclosure mass exploitation waves
92.118.112.100 45.198.224.169 5.175.189.76 45.115.26.26:8000 134.199.154.64:50792 85.11.167.243 217.60.242.76
Mirai Loader, Payload & C2 Arctic Wolf Labs — Potassium Mirai staging (/nfs-setup, /mountpoint, :8000/cCmono) & C2 listener (:50792)
thunder.godofthunder.st hackattackkaboom.botlesscucks.st 206.188.197.105:9999
Botnet C2 & Exploit Staging Potassium Mirai C2 domains & staging server hosting aslr_exploit.py, php2shell_fp.py, deep_probe.py, wp_attack.py
87.121.84.174 181.215.186.252 185.196.220.132 185.161.210.29 152.233.51.69
Mass Scanner Nodes High-volume automated PHP2Shell reconnaissance & PHPSESSID heap memory-leak scanner nodes
e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486
SHA-256 Payloads Arctic Wolf Labs — Dropper script (nfs-setup) & Potassium Mirai ELF binary (cCmono / mountpoint)
References & Advisories: Censys: Live PHP2Shell Exposure Dashboard Google Cloud: Responding to Core PHP Vulnerabilities The PHP Foundation: Oct 21 Security Release Wiz Research: PHP2Shell RCE Calif.io: PHP2Shell Discovery & Research AWS Security: MadPot Pre-Disclosure Exploitation The Hacker News: PHP Unpatched RCE Advisory Mattias Geniar: PHP2Shell Early Mitigations & Traps

Other Active *2Shell Advisories

← Back to Overview & URL Scanner
CVE-2026-111497 CISA KEV EPSS 82.64%

Node2Shell

Out-of-bounds write in Google’s bundled Brotli decoder enabling unauthenticated RCE on stock x86-64 and arm64 Node.js, Bun, .NET, and Python services via inbound or outbound HTTP payloads.

Patched Releases Node.js 22.23.4 · 24.22.1 · 26.12.1 · Bun 1.4.4
Full Advisory & Mitigation
CVE-2026-111497 (Envoy/Istio) 5x NGINX CVEs EPSS 82.64% (Envoy)

HTTP2Shell

Perimeter ingress gateways and service meshes face the same Brotli decoder RCE in Envoy Proxy and Istio alongside five NGINX worker memory, HTTP/3, and mTLS bypass vulnerabilities.

Patched Releases NGINX 1.31.7 / 1.30.6 · Envoy 1.40.0 / 1.39.3 · Istio 1.31.2
Full Advisory & Mitigation