PHP runs a large share of the web, and two flaws in it triggered an unusually urgent response. Details leaked on October 20, a day ahead of PHP’s public disclosure and emergency fixes. In response to PHP’s announcements, CISA and the UK’s NCSC urged organizations to patch immediately, and CERT-EU advised isolating systems where patching was not possible. Government agencies in the Netherlands and Finland pulled websites offline as a precaution. Researchers found the flaws with help from AI models. Attackers did not wait for the fix.
The cause was PHP2Shell: two critical flaws, CVE-2026-109618 and CVE-2026-109619, in PHP itself. One crafted request can give an attacker code execution on an unpatched PHP server, with no login required. Both score 9.2 on CVSS v4.0.
A flaw in the foundation
Both flaws trigger while PHP parses a request, before application code runs. Application-level authentication does not stop them. Magento, Shopware, and WooCommerce stores are affected even when their own code is clean.
No code review of your own apps closes this exposure. Every PHP server needs the update, and PHP’s security advisory lists the fixed versions.
Figure 1: PHP2Shell attack path without protection
AI is shrinking the time from discovery to attack
PHP2Shell shows how fast that window can close. A PHP developer spotted signs of the underlying memory problem in a 2024 audit, but no one had shown a route to code execution, and the fix stalled. In August, researchers using AI models found exploitable paths within weeks. Wiz reports that one researcher did the work in about a week. On October 17, roughly two months later, Amazon Threat Intelligence’s MadPot telemetry recorded an exploit attempt, four days before public disclosure.
A weakness once too hard or too costly to exploit can be weaponized much faster when AI lowers the cost of discovery and exploit development. On October 21, the day of PHP’s public disclosure and fixes, watchTowr reported active exploitation attempts, and ELLIO recorded attacks.
Exploitation leaves a pattern on the network
To exploit these flaws, an attacker has to send requests built to break PHP in a specific way. Those requests look different from normal traffic, and your network can see the difference.
CVE-2026-109618 comes from how PHP handles running out of memory, and its triggers tend to use extreme request shapes. Examples include file-upload requests with no declared size, an abnormal number of parts, or floods of empty file fields. For CVE-2026-109619, the signatures look for code hidden in a file name and for session data handled in ways the server does not expect. On October 22, Proofpoint threat detection engineers published eight network signatures for PHP2Shell exploit attempts on the Emerging Threats community forum, providing interim detection and blocking coverage while organizations deploy the PHP patches required to fully remediate the vulnerabilities.
Figure 2:. PHP2Shell network signatures released by Proofpoint
Fix released. Fix deployed. Often weeks apart.
Patching PHP means updating servers, rebuilding container images, and coordinating with hosting providers. Remediation is more difficult for end-of-life branches. PHP’s project publishes no release for 8.1 and older, only source backports for 7.4 through 8.1, so those teams depend entirely on their vendor for a patched package. For them, protection in front of the server matters even more.
The median time to fully remediate a vulnerability on CISA’s Known Exploited Vulnerabilities (KEV) list is 43 days, according to Verizon’s 2026 DBIR. That is how long a typical fix takes to reach affected systems.
Public lists lag too. CISA urged immediate patching, yet, as of October 23, 2026, neither PHP2Shell CVE is in its KEV catalog so triage built on that list misses this threat.
Where teams could not patch in time, the fallback was turning the website off. The answer should not be “until the patch cycle finished.”
How Proofpoint Active Exploits Protection closes the window
Pulling a website offline is a costly way to buy time. Closing the window takes two things: knowing early which vulnerabilities attackers are exploiting and blocking exploit attacks before they execute. Proofpoint Active Exploits Protection delivers both.
It starts with intelligence. Proofpoint Active Exploits Protection draws on threat activity Proofpoint observes directly across its global network and email sources, rather than relying solely on third-party data. This first-party telemetry includes thousands of sensors in more than 100+ countries, visibility into more than 2.37 trillion emails a year, and analysis of more than 600,000 unique malware samples every day. More than 150 researchers validate the signals. The result is a Proofpoint prioritization score and real-time visibility into whether a CVE is being exploited, including CVEs with no KEV entry. PHP2Shell, absent from KEV as of October 23, 2026, is the kind of gap this is built to cover.
That intelligence then becomes protection. Proofpoint Active Exploits Protection shrinks the exposure window with a continuously updated, network-based ruleset. You deploy it into the IDS, IPS, and NGFW infrastructure you already run to detect and block exploit attempts while patching is underway, using proprietary detection coverage mapped to relevant CVEs and exploit activity.
For PHP2Shell, the eight signatures released are already in the Proofpoint Active Exploits Protection ruleset, ready to deploy and protect your organization from these exploit-driven attacks.
Figure 3: PHP2Shell blocked with Proofpoint Active Exploits Protection
Finally, the Active Exploits Protection API puts that intelligence where your team already works. You can pull the prioritization scores and the mapping of CVEs to detection signatures and rules into your SIEM, TIP, and vulnerability management platforms. One query shows an analyst how a CVE is being exploited and which rules protect against it.
Your team sees the threat sooner, gets protection in place while patching is underway, and has a clear answer when leadership asks about exposure.
Beyond PHP2Shell
Patch as fast as you can. Attackers can begin exploiting vulnerabilities within hours, and patching takes weeks. PHP2Shell began as a zero-day exploit, and now every unpatched server is a likely target, with AI shrinking the time from discovery to attack. Proofpoint Active Exploits Protection is built for that gap, with exploit intelligence grounded in what Proofpoint observes and protection on the infrastructure you already run.
Prioritize what matters. Protect while you patch.
Explore how Proofpoint Active Exploits Protection helps stop exploit-driven attacks.