Tech and Security Companies Respond to PHP2Shell Vulnerabilities

What it is

SecurityWeek's roundup of vendor and government responses to PHP2Shell, two critical unauthenticated remote code execution bugs in PHP: CVE-2026-109618 and CVE-2026-109619. Wiz, OpenAI and Calif found them in August 2026. PHP fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one day before the planned disclosure, because the CVE identifiers had leaked online on 20 October.

How it works

CrowdStrike confirmed in testing that one unauthenticated POST request makes an Apache mod_php worker start a shell and run an attacker-chosen command. No vulnerable application code is needed. Red Hat says reliable exploitation of CVE-2026-109618 needs "precise heap manipulation and timing". The page gives no deeper root-cause detail.

Preconditions / Affected

Any PHP build before the fixed versions is in scope, including PHP embedded in appliances and cloud services. CISA and the UK NCSC both warn that PHP may be present without being obvious, so discovery should cover every PHP installation, not only old ones. Cisco Talos estimates that about half of PHP systems will never get a patch, and urges anyone on PHP 8.1 or earlier to move to 8.2 or newer.

Vendor status named on the page:

• Cisco: over 30 products under review, none known to be affected.
• Fortinet: two dozen products not affected, others still under investigation.
• Palo Alto Networks: PAN-OS rates as high severity (CVSS 8.7), fixes in upcoming releases, workarounds available, no known attacks.
• Sophos: the legacy MyUTM licensing portal for end-of-life SG UTM ran a vulnerable PHP and was taken offline on 21 October 2026.
• Google Cloud: App Engine standard runtimes were updated automatically.
• AWS: fixing Elastic Beanstalk, WorkMail, Amazon Linux and Lightsail.
• Ubuntu: fixes for all supported releases on 21 October 2026.
• Debian: fixes for bookworm and trixie.
• cPanel, Plesk and DirectAdmin: patched. cPanel and Plesk also built fixes for end-of-life PHP 7.4, 8.0 and 8.1.

What to do

• Patch internet-facing systems first, to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later (CISA).
• Where patching must wait, isolate internet-facing applications until the fix is applied and verified (CERT-EU). Qualys has a mitigation that switches off PHP's session upload-progress feature on affected hosts. Palo Alto Networks has published workarounds for PAN-OS.
• Hunt for backdoors planted before patches or mitigations were applied (UK NCSC).
• Watch for updates from vendors of appliances and services that ship PHP. The Dutch NCSC tracks affected PHP-dependent software in a public GitHub repository.
• Detections: Snort Community Ruleset rules (Cisco Talos), open source Zeek and Suricata detections (Corelight), Falcon Next-Gen SIEM content (CrowdStrike), and behavior signatures and four application control rules (Broadcom Symantec and Carbon Black).

Caveats

Red Hat scores both bugs 8.1 and does not rate them critical, against NVD's 9.8. It says remote code execution is difficult in practice and typically needs non-default behavior. CrowdStrike's test against mod_php shows a simple path, so the two assessments conflict.

Exploitation began before the patches. Amazon saw the first attempt on 17 October 2026. Hadrian, Patchstack and Cloudflare saw attempts in the hours before release. WatchTowr saw mass exploitation soon after, though the public PoCs it saw did not achieve code execution. JFrog warns that fake PoCs appeared around disclosure. Coalition honeypots logged matching requests on 20 and 21 October 2026, so a host unpatched in that window may already be compromised. Per Reuters, several European government, school and hospital sites went offline on 21 October 2026.