PHP is cooked - patch the forum

[chants]

PHP2Shell effects PHP versions 5.4 – 8.5. Remote code execution, so it is pretty seriously. Seems like it leaked prematurely. Found by AI unsurprisingly. The real question is why did PHP sit on this for a month before starting to work on it.

Article:

https://www.wiz.io/blog/php2shell-php-rce

Here is the proof of concept:

https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

Given exetools is on vBulletin which uses PHP, admins should be notified as this is pretty severe.

[chants]

So after the 2 remote code execution (RCE) are fixed, I have seen two new security issues one seems to be DoS the other RCE in the new 8.5.12.

https://github.com/rafalohaki/php2shell-poc

Some are saying unpatchable based on it being in FastCGi Process Manager (FPM).

Seems narrow though:

This is not universal RCE. It is an LFI amplifier that works on a narrow class of applications: those that include() a user-controlled path without appending an extension, with cleanup=Off.

In public code the pattern include($x . '.php') dominates, which is why this technique has a small real-world surface.

We should keep a close watch on PHP though as it is getting a lot of scrutiny and I would not be surprised if more severe flaws are found

Latest info on updating and protecting servers:

https://github.com/syhunt/php2shell-protection#public-research-update-configuration-dependent-rce-demonstration-on-php-8512-22-october-2026

[Farooq Ali]

Originally Posted by chants

Given exetools is on vBulletin which uses PHP, admins should be notified as this is pretty severe.

Forum is behind Cloudflare.
Although updating is good, we are already protected to a large extent even if we do not update in a hurry. We already have the upstream protection from CF.

Official blog:

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

"Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell."

[chants]

True but they describe it as a "STOPGAP only" so it just buys some time, not a solution that means one should ignore or avoid patching.