Affected Systems
PHP 8.4.26 and likely earlier versions. Affects approximately 70% of websites globally (~5.1 million exposed PHP hosts). Confirmed exploitation against Apache mod_php installations. A third unpatched RCE (CVE-2026-115560) also disclosed with limited exploitability.
Exploitation Status
Active exploitation confirmed. Adel Karimi (Perplexity) documented successful RCE with memory disclosure against Apache mod_php running PHP 8.4.26. Amazon Threat Intelligence observed targeting 4 days before patches released. Public PoC exploits exist. Earlier attempts (pre-patch) were unsuccessful; confirmed working exploits now in use.
Business Impact
Critical impact for organizations running PHP-based web applications. Successful exploitation enables full remote code execution, allowing attackers to compromise web servers, exfiltrate data, establish persistence, and pivot to internal networks. With 70% of websites using PHP, attack surface is massive. Exploitation complexity appears moderate on specific configurations (Apache mod_php single-worker). CISA has not yet added to KEV catalog despite confirmed exploitation.
Urgency
🔴 Immediate
Recommended Actions
- Immediately patch all PHP installations to versions released October 21, 2026 or later (post-PHP2Shell fixes)
- For CVE-2026-115560 (unpatched RCE), set session.upload_progress.enabled=0 in php.ini until patches are available
- Deploy CISA's published SIGMA detection rule to identify PHP2Shell exploitation attempts in web server and application logs
- Review Apache mod_php installations as priority targets; assess worker configuration and exposure
- Monitor for suspicious outbound connections, unexpected PHP process behavior, and large cookie dumps (~800 KiB) in HTTP responses
- If patching is delayed, consider WAF rules blocking known exploit patterns or temporarily disabling vulnerable PHP endpoints