Patch Now: PHP Flaws Exploited in the Wild as Stolen Microsoft Tokens Hit 79 Organisations

Security teams are starting the week with two urgent warnings: PHP flaws patched less than a week ago are already being exploited in the wild, and a campaign that replayed stolen Microsoft 365 session tokens reached email accounts at 79 organisations. The advice from researchers is blunt — patch PHP now, and revoke sessions rather than assuming a password change is enough.

FAKTA

• PHP2Shell flaws: CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2, patched on 21 October 2026.
• Fixed versions reported: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with workers fully restarted after upgrading.
• Scanning reported: 216 internet-facing hosts compiled as apparently unpatched or only partly mitigated.
• Microsoft 365 campaign: 497 sign-ins counted across 79 organisations, using replayed session tokens.
• Separate PHP flaw: CVE-2026-115560, with no patch reported, mitigated by setting session.upload_progress.enabled=0.

PHP security patch: what is being exploited

The PHP flaws, known as PHP2Shell, allow remote code execution — meaning an attacker who can reach a vulnerable server may be able to run their own commands on it. Researchers at Cyfirma, cited in Monday’s cyber briefings, reported that operators had compiled a list of 216 internet-facing hosts that still appeared unpatched or only partly mitigated for the two flaws, and were probing them from compromised scan nodes.

The reported targets span government, banks, logistics, airports, manufacturing and online transaction platforms. The briefings describe the operators as Korean-speaking and link the scanning to a suspected North Korean campaign; that attribution is reported by the researchers, not independently confirmed here.

Patching means upgrading to one of the fixed versions — 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch in use — and fully restarting the workers afterwards. An upgrade without a restart may leave vulnerable processes running.

Stolen tokens bypass passwords and checks

The second warning concerns Microsoft 365. Security firm Huntress, cited in the same briefings, described a campaign that replayed stolen session tokens for weeks to reach email accounts at 79 organisations, bypassing multi-factor authentication. In total, 497 sign-ins were counted.

The lesson matters because a session token represents a login that has already passed verification. If it is stolen, an attacker may not need the password or the second factor at all. Defenders are advised to revoke sessions, remove rogue devices and unauthorised multi-factor methods, and hunt for sign-ins that do not match the user’s normal pattern.

File photo: a cybersecurity operations environment. It does not depict the specific systems named in this report.

One more PHP flaw, and what to do first

Briefings also flag a newer PHP flaw, CVE-2026-115560, for which no patch was reported on Monday. The interim mitigation given is to set session.upload_progress.enabled=0. Organisations should treat that as a temporary control, not a substitute for the patched versions above.

In practical order: first, inventory every internet-facing PHP host and confirm its version; second, upgrade and restart; third, review Microsoft 365 sign-ins and revoke any session that cannot be explained; fourth, check for unexpected devices or authentication methods added to accounts.

Related Articles

• Related coverage on the PHP2Shell flaw
• Related coverage on government technology restrictions

Conclusion

Both warnings point in the same direction: the fastest risks this week are not exotic new techniques but known flaws left unpatched and valid sessions left unrevoked. Closing those two gaps first gives defenders the most protection for the least delay.

Frequently Asked Questions

What is PHP2Shell?

It is the name given to two critical PHP remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, patched on 21 October 2026.

Which PHP versions fix the flaws?

The fixed versions reported are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Workers must be fully restarted after upgrading.

Why does changing a password not stop token replay?

A stolen session token can represent an already-verified login, so it may work without the password or second factor. Sessions must be revoked directly.

What should an organisation check first?

Its internet-facing PHP versions, its Microsoft 365 sign-in history, and any unfamiliar devices or authentication methods on accounts.

What about the newer flaw CVE-2026-115560?

No patch was reported on Monday; the interim mitigation given is setting session.upload_progress.enabled=0.