PHP Critical Flaws: Mass Attacks Hit 15 Minutes After the Patch

Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were scheduled for a fix on October 21 at 16:00 Paris time, or 14:00 UTC. Security firm Sansec reportedly observed mass exploitation fifteen minutes later. This analysis separates what the sources confirm, what remains disputed and what matters for crypto payment and DeFi services.

A tight patch window, but inconsistent dates

According to Journal du Coin, the main source for this timeline, PHP’s security team was due to publish the fix on October 21 at 16:00 Paris time. Sansec reportedly observed the first attacks fifteen minutes later, after comparing the old code with the patched version to rebuild the exploit. This kind of patch diffing turns a public fix into a working blueprint.

The timeline itself is inconsistent. The article places the initial disclosure on ‘Monday, October 20 morning’ and the release on ‘Wednesday, October 21 at 14:00 UTC’, while also referring to a ‘Thursday’ announcement and to CVE identifiers dated 2026. In 2025, October 20 was a Monday and October 21 a Tuesday; in 2026, those dates fall on a Tuesday and a Wednesday. No single year reconciles every day cited.

An initial alert reportedly appeared on Hacker News on Monday morning. The post was later deleted, but a screenshot preserved a tool called PHP2Shell, attributed to Calif.IO, whose banner claimed it worked on every PHP release since 5.4.0 (2012). That claim describes the tool shown in the image; it is not independent confirmation of the affected versions. watchTowr researchers reportedly confirmed both flaws and reproduced the first, but no public exploit code had been identified. Huntress observed no attacks against its customers on October 20.

Remote code execution rated 9.2 out of 10

Both flaws are described as remote code execution (RCE) vulnerabilities: a properly crafted web request could run an arbitrary command on the targeted server. Each received a CVSS v4.0 severity score of 9.2/10, placing them in the critical category. PHP’s team reserved the right to release the patch earlier if new information emerged.

“if details became public or active exploitation appeared”

PHP security team, as reported by Journal du Coin

Which versions are actually in scope?

Per the article, the official fix was to cover PHP 8.2 and later, the only branches still maintained. Servers on PHP 8.1 or 7.4 were therefore not expected to receive an upstream patch and would depend on a hosting provider backport or a same-day migration.

Scope: Sansec’s claim versus the official patch

Sansec states that the flaws affect all web servers running PHP 5.4 or newer, a far broader scope than the official patch. The PHP 5 changelog consulted confirms that the branch received security fixes in the past, including CVE-2016-5114, a memory leak and buffer overflow in fpm_log.c, and CVE-2016-1903, an out-of-bounds array read in gdImageRotateInterpolated. It also lists a WDDX use-after-free, an XMLRPC type confusion and strict session handling against session fixation.

That changelog, however, contains no entry for CVE-2026-109618, CVE-2026-109619 or PHP2Shell. It documents the branch’s maintenance history without independently corroborating the 2026 incident. Still undisclosed are the number of servers hit, request volumes, affected countries, attacker identities and technical details of the exploits.

An operational risk for crypto payments, with no confirmed target

PHP powers WordPress, WooCommerce, Magento, many back offices, and numerous payment and customer-account pages. The source says that stores accepting USDC ‘almost always’ run WooCommerce, Magento or Shopware, and that exchange websites and support systems are frequently PHP-based. This describes an exposed surface, not a targeted campaign: nothing in the article shows these flaws were used against crypto services specifically.

The consequences described remain hypothetical. After gaining server access, an attacker could swap a deposit address shown at checkout, inject a fake login form or install a keylogger. Magecart groups tracked by Sansec could display a false page on a genuine domain behind a valid security certificate. For DeFi front ends, the main danger would be redirecting users.

Recommended measures

1. Inventory every PHP installation, including those embedded in third-party software.
2. Disconnect from the internet any system running an end-of-life version.
3. Reserve the 16:00-17:00 window and prepare the update command in advance.
4. Monitor for php-fpm or apache2 processes suddenly launching a shell or curl.

CERT-EU issued similar guidance in advisory 2026-018, published Monday evening, advising operators unable to patch in time to remove exposed applications from the public network. A web application firewall is not considered sufficient, because the attack targets PHP itself, upstream of the site’s code. No compromise indicators had been published yet.

By comparison, Log4Shell in December 2021 reportedly produced hundreds of thousands of attack attempts within 72 hours. Here, defenders knew the patch timing in advance. The article reports no quantified market reaction, such as share price moves, trading volume, crypto-asset price impact or loss figures.

Separate flaws that should not be conflated

CVE-2024-4577, an argument-injection flaw affecting PHP on Windows, was exploited extensively after its June 2024 disclosure. GreyNoise recorded attempts from 1,089 unique IP addresses in January alone, and said more than 40% of attacking addresses in the prior 30 days were based in Germany and China.

“GreyNoise data confirms that exploitation of CVE-2024-4577 extends far beyond initial reports.”

GreyNoise, as reported by Cybersecurity Dive

Cisco Talos separately documented an unknown actor using TaoWu plug-ins for Cobalt Strike against Japanese telecoms, technology and education organisations. Talos assessed with moderate confidence that the objective went beyond credential theft, citing persistence and privilege elevation to SYSTEM level.

Two 2026 PHP advisories also matter. CVE-2026-12184 is a remotely triggerable denial-of-service flaw in the HTTP stream wrapper when TLS setup fails, which can crash PHP-FPM; it is fixed in 8.3.32, 8.4.21 and 8.5.6. CVE-2026-14355 is an incorrect buffer-size calculation in the OpenSSL extension’s AES-WRAP-PAD implementation, requiring high attack complexity and no authentication; it is fixed in 8.2.32, 8.3.32, 8.4.23 and 8.5.8.

On a strategic level, New Relic estimates that PHP-based applications account for more than 77% of web applications. TuxCare notes that PHP remains among the most targeted projects by CVE count, with end-of-life branches from 5.2 to 8.0 still in circulation.

These generic measures are presented separately from the specific October 2026 RCE flaws, which remain the core subject of this article.

Outlook and scenarios to watch

Three paths remain open. The most likely at this stage: patches are applied quickly on supported branches and incidents stay concentrated on unpatched servers. A second scenario sees broad exploitation reach 7.4 and 8.1 deployments, which have no upstream fix, forcing hosts to rely on backports. A third would involve confirmed compromise of payment pages or DeFi interfaces; nothing of that scale is documented yet.

Key data to watch include the corrected versions named in PHP’s official advisory, published indicators of compromise and quantified exposure figures. Until then, the announced timeline and scope should be treated as partially verified.

Sources

• Journal du Coin, PHP critical flaws and PHP2Shell
• PHP.net, PHP 5 ChangeLog
• Cybersecurity Dive, critical PHP vulnerability under widespread cyberattack
• TuxCare, PHP vulnerability blog
• Cybersecurity News, multiple PHP vulnerabilities DoS
• New Relic, PHP vulnerabilities to watch for

Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.