CVE-2026-109618, AKA PHP2Shell was disclosed on 2026-10-21. An exploit, PHP2Shell was distributed in the wild and traces were first found on 2026-10-17, creating an emergency situation that resulted in the shutdown of a meaningful chunk of the internet while patches were rolled out.
Worse than a “zero day,” a negative four day.
CVE-2026-109619 reaches a freed object through a fatal-error backtrace and, with OPcache’s help, turns type confusion into code execution. Both trigger from an unauthenticated multipart/form-data request to a PHP endpoint; no login, no special URL. Two days later a follow-on, CVE-2026-115560 (pending still final assignment), showed the same chain working through a serialize handler mismatch. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (and later).
While everyone is either patched (or hacked) by now, the entire world’s PHP infrastructure was open to exploit for at the very least a few days, nearly infinity in internet time, which creates a question: to you restore from backup before 2026-10-17 or scan and patch. Most of us did the latter, but then we all need to scan for likely signs of a successful exploit in vulnerable systems.
Zacharias Creutznacher at Laracraft published a triage script on the day of disclosure: PHP2Shell: were you hit? A read-only triage script for your server, however it didn’t run on FreeBSD and didn’t cover all of the possible post-exploit hacks I was concerned about and had some performance issues on our boxes. Claude assisted in adapting and expanding the script and improving performance.
Our modified script is freely available from gitlab (under a liberal MIT license).