PHP2Shell Timeline: How the Critical PHP RCE Unfolded
The disclosure of PHP2Shell moved fast — attacks began before the patch even shipped. Here is how the day unfolded.
Discovery
The two flaws (CVE-2026-109618 and CVE-2026-109619) surfaced through AI-assisted vulnerability research, with Wiz reporting that the class of bug affects a large majority of PHP deployments. An exploit toolkit under the name “PHP2Shell” followed.
20 October 2026 — advance notice
The PHP project issued advance notice of an upcoming security release, scheduling it for 14:00 UTC the next day. Details of the embargoed flaws then leaked online ahead of the release.
21 October 2026 — attacks, then the patch
- 07:43 UTC: Cloudflare observed the first exploit attempts in the wild — roughly six hours before the fix was public.
- 14:00 UTC: PHP shipped emergency releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing both CVEs (each CVSS 9.2).
The aftermath
- Researchers confirmed unauthenticated RCE against Magento, WordPress, Drupal, Joomla, Laravel, Symfony, phpMyAdmin, Nextcloud, Roundcube, MediaWiki and WHMCS.
- Fixes landed only for supported branches (8.2+); PHP 8.1 and older were left without an official patch.
- Third-party package channels lagged — the Remi repository did not have the fixes at release time, affecting some RHEL-based servers.
The lesson
With exploitation starting before the patch, “wait and see” was never an option. If you haven't yet, check your site now and update PHP.