PHP2Shell is the name for two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution. This post covers the first 36 hours: from the PHP advance notice on 20 October 2026 at 19:30 UTC to 22 October at 07:30 UTC. For the technical detail and the fix, read our main PHP2Shell analysis.
We counted what people said and built around the flaws, using Brandefense threat intelligence data, public posts on X and GitHub search. Counts are lower bounds, and each one says how it was made.
- 17 Oct 2026Earliest attempt on recordAmazon’s honeypot telemetry shows an exploit attempt four days before disclosure.
- 20 Oct, about 15:00CVE ids start to circulateThe PHP Foundation says the ids spread with a wrong release time and a wrong score of 10.0, and that no technical details leaked. PHP rates both 9.2 (CVSS v4.0).
- 20 Oct, 19:30PHP brings the notice forwardThe release is now set for 21 Oct at 14:00 UTC, a day earlier than first planned.
- 20 Oct, about 20:00A proof-of-concept video leaksThe PHP Foundation says the researchers published it by mistake and deleted it, but copies spread.
- 21 Oct, 03:02Cloudflare turns on WAF rulesProtections go out to free and paid plans before the patch exists.
- 21 Oct, 07:41Early patched images appearChainguard publishes images with the fix more than six hours before the coordinated release, says the PHP Foundation.
- 21 Oct, 11:35Exploitation at scale reportedHadrian says it sees PHP2Shell used in the wild at scale.
- 21 Oct, 14:00Patches shipFixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There is no complete mitigation, says PHP.
Conversation Peaked Right at the Patch
We collected 4,176 public X posts matching our searches in the window, from 3,296 accounts. Retweets are not counted. Of those, 1,177 came in the two hours after the 14:00 UTC release. Our collection was capped per search in those hours, and thin between 21:00 UTC on 21 October and 01:00 UTC on 22 October, so the real curve is higher.
Brandefense threat intelligence data, which covers Telegram channels, chat groups and forums, tells the same story. It holds 240 posts matching our searches in the window, from 85 sources, nearly all on Telegram. The busiest two hours were 15:00 to 17:00 UTC on 21 October, with 53 posts.
Public X posts per six hours (UTC)
- 20 Oct 19:30 to 24:004
- 21 Oct 00:00 to 06:00368
- 21 Oct 06:00 to 12:00814
- 21 Oct 12:00 to 18:001,702
- 21 Oct 18:00 to 24:00 (gap)268
- 22 Oct 00:00 to 06:00759
- 22 Oct 06:00 to 07:30261
The 21 Oct 18:00 block is under-collected after 21:00 UTC.
What the Posts Were About
Patching was the biggest topic. Of the X posts, 1,462 mention an update or a fixed version, and 406 mention a WAF or a mitigation. 126 mention a proof of concept or exploit code, and 88 say exploitation is happening. 174 report a service going offline or into maintenance. These are keyword matches, not a reading of each post.
This fits what vendors said. Amazon saw attempts from several actors from 02:00 UTC on 21 October and broad exploitation after 14:00 UTC. Others had not seen it yet: Cisco Talos reported no exploitation as of 14:00 UTC, and Huntress saw none on partner systems at 20:30 UTC. Different sensors saw different things. CISA had not seen exploitation when it published, and on the morning of 22 October neither CVE was in its Known Exploited Vulnerabilities list.
Side Stories From the First 36 Hours
A fast story attracts opportunists. These are the patterns we saw. We describe them and do not link to any of them.
- What
- 10 different token contract strings appeared, 9 on X and 3 in our data, with 2 seen in both. The first was on X at 03:55 UTC on 21 October.
- Volume
- 68 X posts and 13 posts in our data promote them or come from trading bots (keyword match).
- Our view
- We could not verify any claim about price or value. Bot posts about them flag a large share held by bundled wallets, a common pump-and-dump sign. Treat them as likely scams. We do not name or link them.
- Reply spam
- One small account posted 17 times between 19:48 and 20:31 UTC on 21 October, 16 of them replies to other people, all linking to the same site that says it tracks the global response.
- New domains
- Certificate logs show TLS certificates for nine exact domains named php2shell, such as php2shell.com and php2shell.io. All nine had one by 21:16 UTC on 21 October, the first at 22:13 UTC on 20 October. A certificate says nothing about who runs a site or why.
- Free checkers
- Tools that ask you to paste your URL send that address to a stranger. Use one only if you know who runs it.
- Example
- Two near-identical posts at 13:47 and 13:50 UTC claimed that PHP 8.2 got no fix. PHP.net lists 8.2.35 as fixed.
- Honeypots
- One post at 05:31 UTC claimed that another team’s honeypots had already caught the exploit. We could not confirm it. The early sighting we checked is the Amazon post above.
GitHub Filled Up Within Hours
GitHub search shows about 380 repositories created in the window that mention “php2shell”, 342 with the name in the repository name. 28 had at least 10 stars and 5 had 100 or more. Some descriptions warn that the code is AI-generated, untested or a lab fixture. We did not download or run any repository, and we cannot say which ones are safe. Public exploit code is a risk to whoever runs it. Learn more about the terms in our proof of concept entry.
What to Do Now
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Restart PHP-FPM or the web server after. See patch management.
- PHP 8.1 and older get no new release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship fixes. If you cannot update, take PHP systems offline until they are patched, as CISA advises.
- Check for web shells and for web server processes that start a shell, because attempts began before the fix existed.
- Do not run exploit code from a repository you cannot verify.
- Map where PHP runs on your internet-facing systems with external attack surface management. Our free PHP vulnerability check gives a quick first view.
Watching criminal chatter helps you see what is coming. Our dark web monitoring and cyber threat intelligence work follow stories like this one as they form. The same pattern appeared in the WP2Shell WordPress flaw. Exploiting public-facing software maps to T1190.
How We Counted
The window is 36 hours from the PHP advance notice. Counts are posts matching our searches, with duplicates removed by post id: on X “php2shell”, the two CVE ids, “php 8.5.12”, “php rce exploit” and “PHP_SESSION_UPLOAD_PROGRESS”; in Brandefense threat intelligence data “php2shell”, the two CVE ids and “php rce”. Some matches are about the PHP release in general. GitHub counts are repositories created in the window from public search, which excludes forks. All counts were read on the morning of 22 October 2026 and will grow. They show scale and timing, not the number of victims.