Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

What it is

PHP2Shell is the name Unit 42 gives to CVE-2026-109618 and CVE-2026-109619, two PHP remote code execution flaws rated 9.2 (CVSS 4.0). The 29 October 2026 update says they are being exploited against PAN-OS management interfaces exposed to the internet. Dream Research reported a campaign that chained PHP2Shell with a Linux kernel privilege-escalation flaw to get root. Unit 42 says it independently verified the attacker's tooling and confirmed the results. The page does not name the kernel CVE.

How it works

• CVE-2026-109618: handling an out-of-memory error through longjmp() leaves request memory uninitialized. Attackers can trigger OOM conditions to reach RCE reliably.
• CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing at freed regions. Later requests can read or branch on that memory, which allows arbitrary code execution.

Preconditions / Affected

• On PAN-OS, the exposure is a management interface reachable from the internet. By default it is not exposed, per Palo Alto Networks best practice.
• Palo Alto Networks says about 0.02% of its installed base had internet-facing management interfaces and were impacted. It says each of those customers was contacted individually.
• Palo Alto Networks says customers who applied the available patches are not affected, because the fixes interrupt the observed exploit chain.
• Cortex Xpanse counted over 22.6 million potentially vulnerable exposed instances of PHP generally.

What to do

• Remove public internet access to PAN-OS management interfaces if enabled.
• Restrict management access to trusted internal IP addresses.
• Apply the PAN-OS fixes. Affected versions and patch availability are in the Palo Alto Networks security advisory, not in this brief.
• Apply the PHP Group's patches for general PHP deployments.
• Next-Generation Firewall coverage: Advanced Threat Prevention Plus with Frontier Virtual Patching, via Threat ID 543004, since 10:21 p.m. PT on 20 October 2026. Advanced Threat Prevention with best practices has had signatures since 21 October 2026, listed in the advisory.
• Xpanse customers can enable the PHP Attack Surface Rule to find exposed devices.
• The brief references Cortex XDR XQL hunting queries, but they are not in the fetched text. Retrieve them from the page itself.

Caveats

• Unit 42 published a claim on 23 October 2026 of post-compromise activity, then retracted it on 25 October. The activity was an attack on a European government agency, run through a vulnerable PHP application. Unit 42 could not tie the initial access to these CVEs.
• The kernel privilege-escalation flaw is unnamed here. Dream Research's write-up, "Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers", is linked as a resource and may carry more detail.
• Much of the page lists Palo Alto Networks products and services. Beyond the items above, it gives little technical detail on exploitation or indicators of compromise.