# Special edition: CVE-2926-109618 (Update \#4)

> Sophos retracts its compromise report; PHP adds separate, narrowly scoped guidance

- Series: It's Probably Nothing
- Special edition: CVE-2926-109618
- As of: 2026-10-23T18:04:43.022Z
- [Subject history and latest update](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff)
- Publisher: Sierra Echo Charlie
- Edition date (Pacific/Auckland): 2026-10-24
- Edition number: 11
- Status: Published edition
- Language: en-NZ
- [Canonical web edition](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff/1c263639-3fb5-40fb-9117-e26a3d98a211)
- [Download PDF](https://ipn.nz/pdf/IPN-special-1c263639-3fb5-40fb-9117-e26a3d98a211.pdf)
- [MP3 audio](https://ipn.nz/audio/IPN-special-1c263639-3fb5-40fb-9117-e26a3d98a211.mp3) (3:46, 3621241 bytes)
- [Standalone transcript](https://ipn.nz/transcripts/special-1c263639-3fb5-40fb-9117-e26a3d98a211.md)

## Opening

PHP2Shell still warrants urgent patching; the live-attack evidence is narrower than our last edition reported. Current to 07:04 NZDT on 24 October, or 05:04 AEDT.

## 1. What changed

Sophos has withdrawn the successful-compromise report carried in Update \#3. Its 22 October, 21:21 UTC correction reports scanning and failed attempts, with no evidence of successful compromise in its telemetry. The suspected Potassium/Mirai payload wasn't delivered because the attempt was blocked. That's a correction to our lead, not an all-clear elsewhere.

PHP's 23 October notice adds a separate RCE vector, CVE-2026-115560—not a failure of the original fixes. With upload progress enabled, exposure requires an application configured with the php\_binary or php\_serialize session handler to switch to php at runtime before session\_start(). PHP recommends session.upload\_progress.enabled=0 until the next regular bugfix release; applications that never change handlers at runtime can retain the feature.

### Sources

- [Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)](<https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619>) — primary source
- [PHP — Informational advisory: Session upload progress](<https://www.php.net/archive/2026.php>) — primary source
- PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 — primary source
- [PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)](<https://aws.amazon.com/security/security-bulletins/2026-143-aws/>) — primary source
- [Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products](<https://security.paloaltonetworks.com/CVE-2026-109618>) — primary source

## 2. The underlying risk hasn't disappeared

The published identifiers are CVE-2026-109618 and CVE-2026-109619. These PHP-core bugs leave incompletely initialised or freed request state available for later code to consume. PHP puts all web-serving installations in scope.

mod\_php has the highest demonstrated risk, including RCE before application code runs. FPM has validated RCE for the second flaw, requiring suitable application behaviour; PHP hasn't demonstrated a complete FPM exploit for the first. Code runs as the web worker, not automatically root.

### Sources

- [CVE-2026-109618 — PHP CNA record](<https://cveawg.mitre.org/api/cve/CVE-2026-109618>) — primary source
- [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](<https://www.wiz.io/blog/php2shell-php-rce>) — primary source
- [PHP — Security advisory: Critical remote code execution vulnerabilities, update now](<https://www.php.net/>) — primary source
- [RCE via OOM corruption](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>) — primary source
- [RCE via stale global state](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>) — primary source

## 3. Keep the earlier investigation window

AWS reports a MadPot exploitation attempt on 17 October, before the 20 October public leak. It doesn't establish success against real systems or how the actor obtained exploit information. Its investigation window still starts from at least 17 October.

VulnCheck now claims commercial exploit support for PHP 8.4.10–8.4.26. That's vendor testing, not proof of portability across arbitrary production deployments.

### Sources

- [Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot](<https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/>) — primary source
- [Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)](<https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619>) — primary source
- PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 — primary source
- [Honeypot Observations on PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell)](<https://github.security.telekom.com/2026/10/php2shell-honeypot-observations.html>) — primary source

## 4. Installed isn't necessarily running

PHP released fixes on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can look older; verify the full package build. Minimal source backports exist for 7.4, 8.0 and 8.1 without restoring normal support.

Replace running workers too. Forge's automatic security updates exclude PHP: update every installed version and restart long-running processes. Configuration workarounds don't fully fix the original pair.

### Sources

- [PHP — Security advisory and update instructions](<https://www.php.net/>) — primary source
- [CVE-2026-109618 \| Ubuntu](<https://ubuntu.com/security/CVE-2026-109618>) — primary source
- [CVE-2026-109619 \| Ubuntu](<https://ubuntu.com/security/CVE-2026-109619>) — primary source
- [php2shell: Patched PHP packages released](<https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/>) — primary source
- [PHP security advisory (CVE-2026-109618, CVE-2026-109619) — Laravel Forge](<https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026>) — primary source

## 5. Supplier fixes aren't interchangeable

Palo Alto Networks limits PAN-OS/Panorama exposure to management web interfaces, not GlobalProtect. Its 26–30 October hotfix dates are estimates, not released fixes. AWS has completed WorkMail's upgrade, but new Lightsail blueprints don't update existing instances.

### Sources

- [Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products](<https://security.paloaltonetworks.com/CVE-2026-109618>) — primary source
- [SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices](<https://cert-portal.siemens.com/productcert/html/ssa-566512.html>) — primary source
- [Vulnerabilities in PHP Affecting Cisco Products: October 2026](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>) — primary source
- [PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)](<https://aws.amazon.com/security/security-bulletins/2026-143-aws/>) — primary source
- [RHSA-2026:88561 — Important: php security update](<https://access.redhat.com/errata/RHSA-2026:88561>) — primary source

## 6. Local impact remains unresolved

NZ NCSC says it's too early to determine national impact. Its useful question for providers: were compromise checks done, not just updates? Patching doesn't remove an existing compromise. NZ/AU victim totals remain unresolved.

### Sources

- [NCSC urges small businesses to check websites and online services following PHP vulnerability](<https://www.ncsc.govt.nz/news/ncsc-urges-small-businesses-to-check-websites-and-online-services-following-php-vulnerability/>) — primary source
- [UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP](<https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/>) — primary source
- [NCSC encourages immediate patching against PHP vulnerability](<https://www.ncsc.govt.nz/news/ncsc-encourages-immediate-patching-against-php-vulnerability/>) — primary source
- [Critical vulnerabilities in PHP](<https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php>) — primary source

## Audio transcript

Narrated using an AI voice.

This is a special edition of It's Probably Nothing on PHP2Shell, the two PHP-core flaws. Patches remain urgent, but the live-attack evidence is narrower than we last reported. This assessment is current to 7:04am New Zealand daylight time on 24 October.

First, a correction to our last edition. In its 22 October correction, Sophos withdrew its successful-compromise report. It now reports scanning and failed attempts, with no evidence of successful compromise in its telemetry. The suspected Mirai-variant payload wasn't delivered because the attempt was blocked. That's a correction to our lead, not an all-clear elsewhere.

PHP's 23 October notice adds a separate remote-code-execution vector, not a failure of the original fixes. With upload progress enabled, exposure requires an application configured with the php\_binary or php\_serialize session handler to switch to php at runtime, before starting the session. PHP recommends setting session.upload\_progress.enabled to zero until the next regular bugfix release. Applications that never change handlers at runtime can keep the feature.

The underlying risk from the original pair hasn't disappeared. These PHP-core bugs leave incompletely initialised or freed request state available for later code to consume. PHP puts all web-serving installations in scope.

mod\_php has the highest demonstrated risk, including remote code execution before application code runs. FPM has validated code execution for the second flaw, requiring suitable application behaviour. PHP hasn't demonstrated a complete FPM exploit for the first. Code runs as the web worker, not automatically as root.

The earlier investigation window still matters. AWS reports an exploitation attempt against its MadPot system on 17 October, before the public leak on 20 October. That doesn't establish success against real systems, or how the actor obtained exploit information. AWS's investigation window still starts from at least 17 October.

VulnCheck now claims commercial exploit support for PHP 8.4.10 through 8.4.26. That's vendor testing, not proof of portability across arbitrary production deployments.

PHP released fixes on 21 October. The fixed upstream releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can look older, so verify the full package build. Minimal source backports exist for PHP 7.4, 8.0 and 8.1, without restoring normal support.

Installing the package isn't necessarily the end of it: replace running workers too. Forge's automatic security updates exclude PHP, so update every installed version and restart long-running processes. Configuration workarounds don't fully fix the original pair.

Supplier fixes aren't interchangeable, either. Palo Alto Networks limits PAN-OS and Panorama exposure to management web interfaces, not GlobalProtect. Its 26 to 30 October hotfix dates are estimates, not released fixes. AWS has completed WorkMail's upgrade, but new Lightsail blueprints don't update existing instances.

New Zealand's NCSC says it's too early to determine national impact. Its question for providers is whether compromise checks were done, not just updates. Patching doesn't remove an existing compromise, and New Zealand and Australian victim totals remain unresolved.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.

## Publisher

Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com).

Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)