# Special edition: CVE-2926-109618 (Update \#3)

> A reported compromise and a pre-disclosure attempt broaden the investigation window

- Series: It's Probably Nothing
- Special edition: CVE-2926-109618
- As of: 2026-10-22T17:25:10.154Z
- [Subject history and latest update](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff)
- Publisher: Sierra Echo Charlie
- Edition date (Pacific/Auckland): 2026-10-23
- Edition number: 10
- Status: Published edition
- Language: en-NZ
- [Canonical web edition](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff/115faee9-2f73-4fee-9425-7853e98e4c46)
- [Download PDF](https://ipn.nz/pdf/IPN-special-115faee9-2f73-4fee-9425-7853e98e4c46.pdf)
- [MP3 audio](https://ipn.nz/audio/IPN-special-115faee9-2f73-4fee-9425-7853e98e4c46.mp3) (3:49, 3662619 bytes)
- [Standalone transcript](https://ipn.nz/transcripts/special-115faee9-2f73-4fee-9425-7853e98e4c46.md)

## Opening

PHP2Shell has moved beyond reported attempts: Sophos now reports a successful compromise. Patches are available, but the investigation window starts before disclosure. Current to 06:25 NZDT on 23 October, or 04:25 AEDT.

## 1. What changed

Since Update \#2, the evidence has strengthened: Sophos reports successful exploitation, AWS identifies an earlier attempt, VulnCheck describes an ASLR-bypassing exploit, and AlmaLinux’s remaining fixes have reached production.

Sophos’s 22 October, 16:18 UTC update reports malware execution, apparently a Mirai variant called potassium. That remains Sophos’s observation, not an independently inspectable victim investigation. It hadn’t observed evidence connecting the activity to ransomware, data theft or supply-chain compromise.

AWS dates a MadPot exploitation attempt to 17 October, but doesn’t establish whether it would have succeeded against a real system or how the actor obtained exploit information. Its recommendation is to investigate from at least that date, not disclosure.

VulnCheck says its commercial CVE-2026-109618 exploit achieved RCE on PHP 8.4.26, x86-64, with ASLR enabled and display\_errors disabled. Its ARM64 RCE attempt failed. Those are specified test conditions, not universal exploitability.

### Sources

- [Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot](<https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/>) — primary source
- [Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)](<https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619>) — primary source
- PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 — primary source
- [php2shell: Patched PHP packages released](<https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/>) — primary source

## 2. The leak wasn’t the beginning

The published identifier is CVE-2026-109618; CVE-2926-109618 appears to be a typo in a quoted watchTowr post. Its companion is CVE-2026-109619. Wiz says it reported the flaws on 24 August. Their existence leaked publicly on 20 October; PHP released fixes on 21 October.

### Sources

- [CVE-2026-109618 — PHP CNA record](<https://cveawg.mitre.org/api/cve/CVE-2026-109618>) — primary source
- [PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early](<https://www.cyberkendra.com/2026/10/php-cve-2026-109618-cve-2026-109619-rce.html>) — reporting/context
- [Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming](<https://news.ycombinator.com/item?id=50167754>) — primary source
- [Upcoming Critical PHP Security Release](<https://news-web.php.net/php.announce/509>) — primary source
- [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](<https://www.wiz.io/blog/php2shell-php-rce>) — primary source

## 3. FPM still isn’t an exemption

These are PHP-core lifecycle bugs, both rated CVSS v4.0 9.2. CVE-2026-109618 leaves incompletely initialised memory reachable after an out-of-memory abort. CVE-2026-109619 leaves freed request state for a later request in the same worker to consume.

PHP puts all web-serving installations in scope. mod\_php has the highest demonstrated risk, including RCE before application code runs. PHP hasn’t demonstrated a complete FPM exploit for the first flaw; the second has confirmed FPM RCE requiring suitable application behaviour after startup. FPM isn’t a get-out-of-patching card.

Impact includes code execution as the web worker and memory disclosure, not automatic root access.

### Sources

- [PHP — Security advisory: Critical remote code execution vulnerabilities, update now](<https://www.php.net/>) — primary source
- [RCE via OOM corruption](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>) — primary source
- [RCE via stale global state](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>) — primary source

## 4. Check the build, then replace the workers

Upstream fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Backports can look older: Ubuntu 24.04’s 8.3.6-0ubuntu0.24.04.13 fixes both. Minimal source backports exist for 7.4, 8.0 and 8.1 without restoring normal support.

AlmaLinux’s production rollout began at 21:15 UTC on 21 October; use its production repositories and verify the full package build. Forge’s automatic security updates exclude PHP: update every installed version and restart long-running processes. PHP says configuration workarounds aren’t a complete solution.

### Sources

- [PHP — Security advisory and update instructions](<https://www.php.net/>) — primary source
- [CVE-2026-109618 \| Ubuntu](<https://ubuntu.com/security/CVE-2026-109618>) — primary source
- [CVE-2026-109619 \| Ubuntu](<https://ubuntu.com/security/CVE-2026-109619>) — primary source
- [php2shell: Patched PHP packages released](<https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/>) — primary source
- [PHP security advisory (CVE-2026-109618, CVE-2026-109619) — Laravel Forge](<https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026>) — primary source

## 5. Don’t stop at websites

NZ NCSC also flags PHP embedded in firewalls, edge devices and other platforms: those may need separate vendor remediation. Patching doesn’t remove an existing compromise. Victim numbers, campaign scale and NZ/AU impact remain unresolved.

### Sources

- [UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP](<https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/>) — primary source
- [NCSC encourages immediate patching against PHP vulnerability](<https://www.ncsc.govt.nz/news/ncsc-encourages-immediate-patching-against-php-vulnerability/>) — primary source
- [Critical vulnerabilities in PHP](<https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php>) — primary source
- [Vulnerabilities in PHP Affecting Cisco Products: October 2026](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>) — primary source
- [PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)](<https://aws.amazon.com/security/security-bulletins/2026-143-aws/>) — primary source

## Audio transcript

Narrated using an AI voice.

Good morning, this is a special edition of It's Probably Nothing on PHP2Shell, the two PHP core flaws. Patches are available, and reported exploitation now includes a successful compromise. This assessment is current to 6:25am New Zealand daylight time on 23 October.

Since our last assessment, we've moved beyond watchTowr's reported exploitation attempts. Sophos's 22 October update reports successful exploitation and malware execution, apparently a Mirai variant called potassium. That's Sophos's observation, not an independently inspectable victim investigation. It hadn't seen evidence connecting the activity to ransomware, data theft or supply-chain compromise.

AWS now dates an exploitation attempt against its MadPot system to 17 October. That doesn't establish whether it would've succeeded against a real system, or how the actor obtained exploit information. AWS recommends investigating from at least that date, not from disclosure.

VulnCheck also says its commercial exploit for the first flaw achieved remote code execution on PHP 8.4.26, on 64-bit x86, with address randomisation enabled and PHP error display disabled. Its ARM64 remote code execution attempt failed. Those are specific test conditions, not universal exploitability.

The wider timeline matters here. Wiz says it reported the flaws on 24 August. Their existence leaked publicly on 20 October, and PHP released fixes on 21 October. The newly reported AWS attempt predates that public leak.

Both are PHP-core lifecycle bugs, rated 9.2 under CVSS version four. The first leaves incompletely initialised memory reachable after an out-of-memory abort. The second leaves freed request state available for a later request in the same worker to consume. These aren't application-framework bugs.

PHP puts all web-serving installations in scope. mod\_php has the highest demonstrated risk, including code execution before application code runs. PHP hasn't demonstrated a complete FPM exploit for the first flaw. The second has confirmed code execution paths against both mod\_php and FPM, with the validated FPM path requiring suitable application behaviour after startup. FPM isn't an exemption. Code runs with the web worker's privileges, not automatically as root. The second flaw can also disclose memory.

Upstream fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can retain older-looking version numbers: Ubuntu 24.04 has a package fixing both flaws. Check the full package build. Minimal source backports also exist for PHP 7.4, 8.0 and 8.1, without restoring normal support.

AlmaLinux's remaining fixes have now reached production, with its production rollout beginning at 21:15 UTC on 21 October. Use its production repositories and verify the package build. On Laravel Forge, automatic security updates exclude PHP: update every installed version and restart long-running processes. PHP says configuration workarounds aren't a complete solution.

And don't stop at websites. New Zealand's NCSC also flags PHP embedded in firewalls, edge devices and other platforms, which may need separate vendor remediation. Patching doesn't remove an existing compromise. Victim numbers, campaign scale, and New Zealand and Australian impact remain unresolved.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.

## Publisher

Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com).

Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)