Threat reportVulnerabilityTL-2026-4262

PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After Emergency PHP2Shell Patches (CVE-2026-109618/CVE-2026-109619)

criticalACTIVE

PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After (TL-2026-4262), also tracked as PHP2Shell, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-23 and last reviewed 2026-10-28. It has no confirmed attribution, affects PHP Group PHP (CVE-2026-109618 / CVE-2026-109619), references 3 CVEs (CVE-2026-115560, CVE-2026-109618, CVE-2026-109619), maps to 32 MITRE ATT&CK techniques (T1003, T1003.008, T1005), and is covered by 9 detection rules and 159 indicators of compromise.

CVSS
9.2/10Critical
CVEs
3Referenced vulnerabilities
Techniques
32MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
159Indicators of compromise

Key facts for TL-2026-4262

Threat ID
TL-2026-4262
Also known as
PHP2Shell, RCE via OOM Corruption, RCE via Stale Global State
Severity
CRITICAL
CVSS
9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, government administration, finance, health, education, news - media
Target regions
Global
Detection rules
9
Indicators of compromise
159
Updates
2026-10-28 · 13 updates · revalidated 13× · latest source

Malware and tooling in PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

Malware and tooling: Mirai, PHP, Mirai, PHP2Shell

How PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After works

PHP warned of another unpatched remote code execution flaw (CVE-2026-115560) on October 23, two days after emergency patches for the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619). The PHP2Shell flaws are under mass exploitation, with attempts to install Mirai botnet variants; CVE-2026-115560 has not been reported under attack and has no patch yet.

On October 21, 2026 the PHP project shipped emergency releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) for two critical, unauthenticated remote code execution vulnerabilities collectively named PHP2Shell. CVE-2026-109618 (RCE via OOM corruption) arises because out-of-memory handling can interrupt PHP while internal request data is only partially initialized, so request cleanup treats invalid data as valid. CVE-2026-109619 (RCE via stale global state, GHSA-6wmf-4rv5-p3rp) arises because request-owned internal state survives after its backing memory is freed; a later request handled by the same worker can use that stale state before initialization resets it, yielding heap use-after-free, memory disclosure and RCE. Fatal errors or warnings on attacker-reachable paths (invalid INI diagnostics, session upload progress during file uploads) can leave the stale references. Both carry CVSS v4.0 9.2 (GHSA vector for CVE-2026-109619: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). All PHP installations serving web requests are affected (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed), with highest risk for mod_php where an unauthenticated request can trigger the attack. Backports exist for PHP 7.4, 8.0 and 8.1; VirusTotal counted over 5.1 million exposed PHP hosts.

Details leaked on Hacker News on October 20, before the embargo ended; technical analyses and demonstrations against WordPress, Drupal and Joomla followed on October 21. Per The Hacker News, the first attack was seen on October 17 on Amazon honeypots, exploit attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by October 22 (Cloudflare), and Sophos and Arctic Wolf reported attempts to install Mirai botnet variants. watchTowr reported exploitation in its honeypot network on October 21. No confirmed code execution was reported; a reliable exploit is harder to build than expected. VulnCheck found code execution works on ARM64 and x86 systems without ASLR, but very few exploits work and none bypass ASLR on x86-64.

On October 23, 2026 PHP published an informational advisory for CVE-2026-115560, a session upload progress issue leading to RCE. It requires session.serialize_handler to be set to php_binary or php_serialize, the application to switch it to php at runtime via ini_set() before session_start(), and session.upload_progress.enabled to remain on. PHP calls this setup unlikely in practice. No CVSS, affected-version list or CWE is stated for it, it is unpatched (fix planned for the next routine bugfix release), and no exploitation is reported. Severity here is an analyst assessment driven by the actively exploited sibling flaws; the CVSS 9.2 applies to the PHP2Shell CVEs, not to CVE-2026-115560.

No network IOCs (IPs, domains, hashes) have been published by the sources reviewed (Huntress and Tanium both state none are established), so BeaconBeagle correlation was not applicable. Indicators below are behavioral and configuration based.

MITRE ATT&CK techniques used in TL-2026-4262

Credential Access

T1003 OS Credential Dumping; T1003.008 OS Credential Dumping; T1212 Exploitation for Credential Access; T1552.001 Unsecured Credentials; T1557 Adversary-in-the-Middle; T1557.001 Adversary-in-the-Middle

Collection

T1005 Data from Local System

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1087.002 Account Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Cron; T1136 Create Account; T1505.003 Web Shell

Execution

T1059.001 Command and Scripting Interpreter; T1059.003 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.006 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Command and Control

T1090.003 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.002 Endpoint Denial of Service: Service Exhaustion Flood; T1499.004 Application or System Exploitation

Resource Development

T1587.004 Exploits; T1588.005 Obtain Capabilities; T1588.006 Obtain Capabilities; T1608.001 Stage Capabilities

Reconnaissance

T1592.002 Gather Victim Host Information; T1595.002 Vulnerability Scanning

Affected products and versions in PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

  • PHP Group — PHP (CVE-2026-109618 / CVE-2026-109619)
    Vulnerable versions: < 8.2.35; < 8.3.36; < 8.4.27; < 8.5.12; 8.1 and older (no upstream support; limited backports for 7.4, 8.0, 8.1)
    Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12
  • PHP Group — PHP session upload progress (CVE-2026-115560)
    Vulnerable versions: Affected versions not specified in source; requires session.serialize_handler php_binary/php_serialize switched to php via ini_set() before session_start() with session.upload_progress.enabled on

Remediation for PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

Patches

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35
  • Backports available for PHP 7.4, 8.0 and 8.1
  • CVE-2026-115560: no patch yet; fix planned for next routine bugfix release

Immediate actions

  • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (fixes CVE-2026-109618 and CVE-2026-109619)
  • Set session.upload_progress.enabled=0 in php.ini (not via ini_set()) until the next bugfix release; this addresses CVE-2026-115560 and CVE-2026-109619
  • Inventory all PHP installations including OS packages, containers, bundled and vendor-supplied copies
  • Hunt for PHP worker processes spawning shells, interpreters or download tools, and for unexplained PHP worker crashes

Workarounds

  • CVE-2026-109618: memory_limit=-1, post_max_size=8M (32M if uploads required), upload_max_filesize below post_max_size
  • CVE-2026-109619: session.upload_progress.enabled=0; on PHP 8.5 fatal_error_backtraces=0
  • Remove invalid or deprecated INI settings that emit diagnostics before initialization
  • Do not rely on @ error suppression or display_errors; they do not help

Longer-term hardening

  • Migrate off unsupported PHP branches (8.1 and older)
  • Isolate unsupported PHP behind VPN or WAF
  • Enforce web server or proxy limits on request size, field count, multipart parts, headers and nesting depth
  • Use container or cgroup limits with worker kill policies; consider pm.max_requests=1 as a stopgap

CVEs associated with PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

CVE-2026-115560, CVE-2026-109618, CVE-2026-109619

Weaknesses (CWE) in PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419, CWE-193, CWE-401, CWE-190, CWE-476, CWE-674

Timeline of PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

Showing the 20 most recent tracked events.

  • Fortinet publishes guidance and IPS signatures 62657 and 62658 for CVE-2026-109618 and CVE-2026-109619, and notes the separate configuration-dependent CVE-2026-115560.
  • CYFIRMA detects 17 suspected source IP addresses associated with the suspected PHP2Shell staging activity.
  • Canadian Cyber Centre updates alert AL26-026 to add CVE-2026-115560, with the mitigation session.upload_progress.enabled=0.
  • Unit 42 updated its threat brief: a European government entity was compromised within about two hours of initial exploitation. Attackers accessed password hashes and MFA secrets and set up NTLM-relay tunnels into Active Directory. Delimiters such as ==SHELLUSER== and ==PASSWD== and the serially batched task pacing indicate agentic-AI-driven tooling.
  • CrowdStrike Counter Adversary Operations assesses that weaponization obstacles (public PoCs mostly crash-only; reliable RCE must be tuned to PHP version, libc, container image and application) likely constrain widespread exploitation; it observed only testing, probing and unsuccessful attempts, not successful exploitation.
  • Cloudflare states its WAF protects against known exploit attempts when the default upload progress field name is used; BleepingComputer and The Hacker News report no exploitation of CVE-2026-115560 yet.
  • PHP publishes informational advisory for unpatched RCE CVE-2026-115560 (session upload progress); no exploitation reported; mitigation is session.upload_progress.enabled=0
  • VPN exit 178.249.214.6 opens 399 stalled connections to pin Apache workers before the A1/B1 stages; 15.204.59.70 and 162.35.99.94 also attempt exploitation in Wiz telemetry, and the leak stage fails.
  • Operators reportedly share a 216-host list of unpatched or partially mitigated PHP targets and name 21 rotating scan nodes using web-shell tooling and PHP_SESSION_UPLOAD_PROGRESS session-poisoning attempts (CYFIRMA advisory, imminence index 78/100). Successful exploitation of the listed hosts is not confirmed.
  • Confirmed RCE against Apache mod_php with PHP 8.4.26 on the honeypot: Episode A (3 shells, 15:35-16:04 UTC, source 15.204.59.70) and Episode B (32 shells, 16:46-18:57 UTC, source 162.35.99.94). The chain is four POST stages: memory pressure, memory disclosure via an oversized PHPSESSID cookie, memory pressure, then execution.
  • Palo Alto Networks confirmed PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 (PA-Series, VM-Series, Panorama) are affected through the management web interface (product impact CVSS 8.7). It has not confirmed malicious exploitation against its own products. Hotfixes are estimated for October 26-30; Threat Prevention signature 543004 gives interim coverage.
  • 103.151.172.95 runs a legacy chain with 1,001 heap-shaping fields and stalled connections; 172.206.2.199 runs a scanner plus an exploitation attempt.
  • Palo Alto Unit 42 reportedly retracts its earlier claim linking PHP2Shell to the European government breach, saying it could not establish that the initial compromise involved these CVEs (secondary reporting).
  • Defused Cyber reports PHP2Shell probes against Palo Alto Networks GlobalProtect honeypots; The Hacker News publishes a roundup including moderate-confidence Lazarus-ecosystem attribution claims, not independently verified.
  • CISA adds PHP2Shell to the Known Exploited Vulnerabilities catalog; VPN infrastructure 135.136.19.197 is observed attempting exploitation.
  • Security Affairs reports CYFIRMA's moderate-confidence attribution of the staging campaign to the Lazarus family of North Korean groups; no other vendor has confirmed it and CYFIRMA concedes non-state Korean-speaking criminals could fit.
  • CERT-FR updates alert CERTFR-2026-ALE-014.
  • BleepingComputer reports PHP2Shell now successfully exploited in the wild, citing the honeypot-confirmed RCE; Marcus Hutchins (Expel) calls it the highest-quality confirmation of php2shell exploitation.
  • Bishop Fox publishes responder guidance and reproduces unauthenticated RCE against stock php:8.3, 8.4 and 8.5 Apache mod_php Docker images with ASLR enabled over plain HTTP; real OPcache deployments needed per-target recalibration and PHP-FPM targets produced denial of service rather than code execution.
  • Wiz publishes exploitation findings: no successful end-to-end exploitation in its own telemetry and about a 67% drop in distinct exposed vulnerable machines (about 47.9% drop in organizations with an exposed instance) between 2026-10-21 and 2026-10-26.

Update history for TL-2026-4262

Sources cited for PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After

Detection coverage for TL-2026-4262

As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4262 across Splunk SPL, Microsoft KQL and Sigma, covering 159 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
159 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats