PHP has been declared dead roughly once a year since 2009, and every year it shrugs, keeps running about 70% of the web, and goes back to work. This month, though, the old workhorse picked up a nasty case of remote code execution, and attackers are now very much invited to the party.
Two CVEs Walk Into the KEV Catalog
On Monday, October 26, CISA added CVE-2026-109618 and CVE-2026-109619 — collectively nicknamed "PHP2Shell" — to its Known Exploited Vulnerabilities catalog. The pair lets unauthenticated attackers achieve remote code execution, though BleepingComputer notes the attacks are high-complexity. Federal civilian agencies have been given until Thursday to lock things down under Binding Operational Directive 26-04.
The timeline is the kind that keeps sysadmins up at night. The PHP security team warned admins on October 20 and shipped patches on October 21, but details and some proof-of-concept exploits leaked first, and Amazon Threat Intelligence says attackers started probing four days before the fix landed. Over the weekend, a detection and response lead at Perplexity confirmed real-world exploitation: honeypot data showed remote code execution against an Apache mod_php setup running PHP 8.4.26. And as a bonus round, the PHP team published mitigations Friday for a separate, still-unpatched RCE flaw, CVE-2026-115560, which it says is exploitable only under "an unusual combination of configuration and application code."
5.1 Million Hosts and a Very Short Fuse
VirusTotal estimates more than 5.1 million PHP hosts are exposed online, with about 3.8 million showing at least one open port. That's not a target list so much as an all-you-can-eat buffet. If your stack includes PHP — and if you run Drupal, WordPress, or just about any classic CMS, it does — this isn't a "next sprint" ticket. It's a "today" ticket.
Here's the part people miss: patching the PHP runtime isn't always something your CMS updater handles. Core and module updates live in one place; the interpreter lives on the server, often managed by a host, a container image, or an ops team that swears they'll get to it after lunch. That gap between "the site is up to date" and "the server is up to date" is exactly where incidents like this thrive. And with an unpatched sibling bug still floating around, config hardening matters as much as version numbers right now.
The internet runs on PHP, which means the internet's to-do list just got a lot shorter and a lot more urgent. Check your versions, then check them again.
If you're not sure whether your Drupal site's PHP runtime is actually patched — or who on your team is even responsible for it — our team can audit the full stack, from modules down to the interpreter.
Source: BleepingComputer