{"id":34924,"date":"2026-10-28T12:08:40","date_gmt":"2026-10-28T12:08:40","guid":{"rendered":"https:\/\/blog.lacnic.net\/vulnerabilidad-php2shell-en-la-region-de-lacnic\/"},"modified":"2026-10-29T18:20:08","modified_gmt":"2026-10-29T18:20:08","slug":"php2shell-vulnerability","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/php2shell-vulnerability\/","title":{"rendered":"PHP2Shell Vulnerability in the LACNIC Region"},"content":{"rendered":"\n

By Guillermo Pereyra<\/a><\/p>\n\n\n\n

In October 2026, two critical vulnerabilities were disclosed in PHP, the programming language that powers a significant portion of the web. They were identified by researchers from Calif, OpenAI, and Wiz, with the aid of AI models, and their disclosure immediately raised concerns across the cybersecurity community.<\/p>\n\n\n\n

Between October 20 and 22, 2026, PHP2Shell went from rumors to a security patch, followed almost immediately by lists of indicators of compromise (IoCs).<\/p>\n\n\n\n

Over the following days, multiple security vendors released lists of IP addresses, domains, and hashes linked to exploitation of the vulnerabilities.<\/p>\n\n\n\n

In this article, we analyze what publicly available sources reveal about patching progress across Latin America and the Caribbean and provide recommendations for mitigating and remediating these vulnerabilities.<\/p>\n\n\n\n

What Is PHP2Shell and Who Is Affected?<\/strong><\/h2>\n\n\n\n

PHP2Shell refers to two vulnerabilities affecting the PHP interpreter itself: CVE-2026-109618<\/a> <\/u>and CVE-2026-109619<\/a>. Both carry a CVSS v4.0 score of 9.2 (9.8 under CVSS v3.1) and enable unauthenticated remote code execution (RCE) via HTTP requests.<\/p>\n\n\n\n

Severity, however, is only one factor to consider when prioritizing vulnerabilities. Considering two additional indicators provides a more complete picture:<\/p>\n\n\n\n

\n\n\n\n\n\n
\n

Indicator<\/strong><\/p>\n<\/td>\n

\n

CVE-2026-109618<\/strong><\/p>\n<\/td>\n

\n

CVE-2026-109619<\/strong><\/p>\n<\/td>\n

\n

What it measures<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

CVSS v4.0<\/p>\n<\/td>\n

\n

9.2<\/p>\n<\/td>\n

\n

9.2<\/p>\n<\/td>\n

\n

Technical severity if exploited<\/p>\n<\/td>\n<\/tr>\n

\n

EPSS (FIRST, 26\/OCT)<\/p>\n<\/td>\n

\n

99,981%<\/p>\n<\/td>\n

\n

99,997%<\/p>\n<\/td>\n

\n

Probability of exploitation within the next 30 days<\/p>\n<\/td>\n<\/tr>\n

\n

Cat\u00e1logo KEV (CISA, 26\/OCT)<\/p>\n<\/td>\n

\n

Not listed<\/p>\n<\/td>\n

\n

Not listed<\/p>\n<\/td>\n

\n

Confirmed exploitation<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n

According to CVEdetails’ historical data<\/a>, the EPSS<\/a> score for CVE-2026-109618 rose from 11.84% to 99.98% on October 25. As of October 26, FIRST’s public API assigns an EPSS score of 99.981% to CVE-2026-109618 and 99.997% to CVE-2026-109619, placing both in the highest percentile among all scored vulnerabilities. However, as of October 26, neither vulnerability appears in CISA’s Known Exploited Vulnerabilities (KEV) Catalog<\/a>, which includes only vulnerabilities with confirmed exploitation. CISA issued an alert on October 21 urging organizations to apply patches, although it had not observed exploitation, as summarized by Tenable<\/a>.<\/p>\n\n\n\n

Because the vulnerabilities affect PHP itself rather than a specific application, their potential reach is substantial. Any website running a vulnerable version of PHP may be exposed, whether it uses WordPress, Drupal, Joomla, or a custom-built application. The patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, released on October 21. PHP 8.1 and earlier branches no longer receive official patched releases.<\/p>\n\n\n\n

Details of the vulnerabilities leaked ahead of the scheduled disclosure date, prompting the PHP team to release the patch earlier than planned. In addition, Amazon reported<\/a> that its honeypot network recorded an exploitation attempt on October 17, four days before the patch became publicly available.<\/p>\n\n\n\n

It is important not to confuse these vulnerabilities with CVE-2026-115560, disclosed on October 23, which some lists group under the same name. According to The Hacker News<\/a>, this is a separate issue that requires an uncommon configuration and has no reported exploitation.<\/p>\n\n\n\n

Patch Adoption Across the Region<\/strong><\/h2>\n\n\n\n

Censys provides a public dashboard<\/a> that tracks Internet-exposed PHP services running vulnerable or patched versions, with hourly updates and country-level breakdowns. We used these data to analyze 21 countries across the region.<\/p>\n\n\n\n

As of October 26, only 12.8% of PHP services with identifiable versions in Latin America and the Caribbean were running patched releases, compared with 25.1% globally. The region’s patch adoption rate is roughly half the global figure.<\/p>\n\n\n\n

Both figures include servers running PHP versions that no longer receive security fixes, such as PHP 7.4 and earlier, in the unpatched category. These systems remain vulnerable, with no patches available for their current versions. Since Censys does not provide a country-level breakdown of unsupported releases, it is impossible to determine how much of the region’s remaining 87% can be addressed through patching and how much requires migration to a supported version.<\/p>\n\n\n\n

\"vulnerabilidad-php2shell-en-la-region-de-lacnic\"\/<\/figure>\n\n\n\n
\"vulnerabilidad-php2shell-en-la-region-de-lacnic\"\/<\/figure>\n\n\n\n

Additional Data That Help Explain the Situation<\/p>\n\n\n\n