PHP2Shell Zero-Day Exploits Force Immediate Patch for Millions of Sites

PHP2Shell Zero-Day Exploits Force Immediate Patch for Millions of Sites

The two critical vulnerabilities known as PHP2Shell were disclosed in early October 2026 and affect PHP 8.2.x and 8.3.x. The flaws enable attackers to execute arbitrary code on a server that hosts a PHP application by sending a specially crafted HTTP request. The attack surface is broad because PHP powers roughly 70 % of the web.

Attack Vector and Exploit Mechanism

PHP2Shell exploits a flaw in the PHP interpreter’s handling of the eval() function when called with a string that contains a null byte. The null byte terminates the string early, allowing the attacker to inject code that bypasses normal input validation. The second flaw in the pair targets the system() function, enabling command injection through a similar null-byte technique. Both vulnerabilities are triggered via HTTP requests that include a payload in the query string or POST body. Once the payload is processed, the attacker gains a shell on the server with the privileges of the web-server process.

Immediate Patch Requirements

The PHP development team released patches for both CVEs on 12 October 2026. Administrators must update to the latest PHP 8.2.x or 8.3.x release that includes the security fixes. In addition, the following hardening steps are recommended:

1. Disable eval(), system(), and other dangerous functions in php.ini if they are not required by the application.
2. Apply a web-application firewall rule that blocks null-byte injection patterns.
3. Verify that the application’s input validation does not rely on string length checks that could be subverted by null bytes.
4. Run a full vulnerability scan against the public-facing endpoints to confirm that the patch is effective.

The PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x page lists the exact CVE identifiers and provides step-by-step patch instructions.

Refrigeration Controller Compromise in France

In a separate campaign, attackers breached the control systems of up to 700 French supermarkets. The intrusion involved raising refrigerator and freezer temperatures to 50 °C, potentially damaging perishable goods. The attack vector was not disclosed, but the incident highlights the risk of compromised web interfaces that control industrial equipment.

Denmark Central Population Register Breach

Denmark’s Central Population Register (CPR) suffered a data breach that exposed personal information for 8.8 million citizens. The breach was attributed to a third-party provider whose account was protected by the weak password "123456". The incident underscores the importance of enforcing strong password policies and multi-factor authentication for all third-party access.

Android Malware in Cheap Phones

Malware preinstalled on thousands of inexpensive Android devices can generate fraudulent ad revenue and potentially become part of larger botnets. The malware exploits the device’s advertising SDK to display click-bait ads. The presence of the malware was discovered through a combination of network traffic analysis and device forensics.

Operational Impact and Next Steps

Organizations running PHP 8.2.x or 8.3.x must prioritize patch deployment. Failure to do so exposes web applications to remote code execution, which can lead to full server compromise, data exfiltration, or further lateral movement. The incident also demonstrates that attackers are willing to target industrial control systems and personal data repositories, expanding the threat surface beyond traditional web applications.

Security teams should review their vulnerability management processes, ensuring that critical patches are applied within 24 hours of release. Automated scanning tools should be configured to detect the specific null-byte patterns that trigger PHP2Shell. Finally, consider implementing runtime application self-defence mechanisms, such as Web Application Firewalls, to provide an additional layer of protection while patches are rolled out.

Key Technical Takeaways

• PHP2Shell affects PHP 8.2.x and 8.3.x and allows remote code execution via null-byte injection in eval() and system().
• Immediate patching and disabling of dangerous functions are mandatory.
• The broader context of October 2026 incidents shows attackers targeting industrial control systems, personal data stores, and low-cost mobile devices.

The rapid disclosure and exploitation of PHP2Shell demonstrate the necessity of continuous monitoring, rapid patching, and hardened application configurations to mitigate zero-day threats.

Related coverage

• PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites
• PHP2Shell CVEs Force Immediate Patch for Millions of Sites

Explore more on this topic

• More php coverage