php2shell: Is the vulnerability already being exploited?

In our article on the php2shell security vulnerabilities we introduced the two critical vulnerabilities in the PHP core. The situation has developed since then: Amazon reported the first exploitation attempt as early as 17 October 2026 from its own honeypot network, and Cloudflare also confirms active attacks with changing payloads.

In addition, the first proof-of-concept exploits have been published, and automated scanners are already searching on a large scale for vulnerable systems. Because the risk of targeted attacks remains high, we will support you with the fast implementation of the necessary security measures. Contact us directly via our contact form.

How do you recognise whether your web server has been exploited?

Both vulnerabilities work on the same principle: An attacker uses a multipart request to trigger a memory error. During cleanup, corrupted memory remains in the PHP worker, which is then exploited through a follow-up request for unauthenticated Remote Code Execution.

You can primarily recognise the attack by the typical patterns in HTTP requests:

• POST requests that contain the string PHP_SESSION_UPLOAD_PROGRESS.
• Unusually large uploads, some without a Content-Length.

In addition, you can check the PHP and Apache logs for the following log entries: 'Allowed memory size exhausted', segmentation faults or documented crashes of the PHP workers. If you also notice unexpected files, new cron jobs or unknown outgoing connections, this can point to successful exploitation. We support you both with patching your systems and with investigating signs of exploitation of the vulnerabilities.

Recommended actions

If your system runs a PHP version before 8.2.35, 8.3.36, 8.4.27 or 8.5.12, your system is vulnerable and we recommend that you update it. Check the currently used PHP version directly via the web server to prevent your application from using an alternative, outdated PHP version.

• Patch all PHP installations to the latest version and restart your system.
• If your system cannot be updated to the latest version, we recommend disconnecting it from the internet immediately in order to drastically reduce the possible entry path.
• Watch out for unexpected process execution or file changes on the web servers.

You are unsure whether your systems are affected? We check the PHP version you use, run a vulnerability check and support you with patching. In case of suspicion, we carry out forensics and clean up compromised systems.