Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Tech vendors, cybersecurity companies and government agencies have published advisories, detections and mitigations for the PHP2Shell vulnerabilities, while many software makers are still checking whether their own products are exposed.

The two critical bugs, CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers execute code remotely. Wiz, OpenAI and Calif identified them in August, and PHP addressed them on October 21 with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

PHP pushed out the release one day ahead of the planned disclosure, after the CVE identifiers started circulating online on October 20.

Amazon says the first exploitation attempt came on October 17, before the embargo lifted. Hadrian, Patchstack and Cloudflare all detected attack attempts in the hours leading up to the patches. WatchTowr saw mass exploitation soon after the fixes were published, although the PoC exploits in circulation did not achieve code execution.

With PHP built into a wide range of commercial software, appliances and cloud services, companies across the industry have had to check their exposure.

Tech vendors check products, update PHP runtimes

Cisco’s advisory names over 30 products and cloud services under review. Among them are Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Webex and the AppDynamics PHP Agent. “Currently, no products are known to be affected,” Cisco says.

Cisco Talos has outlined the Snort coverage for PHP2Shell, including Community Ruleset rules. Based on open source data, the threat intelligence unit estimates that about half of PHP systems won’t get a patch, and it urges anyone on PHP 8.1 or earlier to move to version 8.2 or newer right away.

Red Hat’s assessment is less severe than NVD’s: it scores both bugs 8.1, compared with 9.8, and doesn’t rate them critical. Regarding CVE-2026-109618, it says that “reliable exploitation requires precise heap manipulation and timing” and notes that “remote code execution is difficult in practice and typically requires non-default behavior”.

On October 21, Ubuntu shipped fixes for all its supported releases, and Debian addressed the flaws in its bookworm and trixie releases.

AWS is addressing the PHP2Shell vulnerabilities in Elastic Beanstalk, WorkMail, Amazon Linux, and Amazon Lightsail. 

Google Cloud itself is not vulnerable, but supported PHP runtimes in the App Engine standard environment were updated automatically, and new base images are being rolled out for the company’s serverless PHP services. 

Among hosting control panels, cPanel, Plesk and DirectAdmin shipped patches. cPanel and Plesk also released fixed builds for the end-of-life PHP 7.4, 8.0 and 8.1 branches. 

SolarWinds says it has reviewed its products and internet-facing assets. “Pingdom uses PHP, but we have implemented compensating controls to protect the product,” the company says. It has taken the same approach for its PHP-based external website and says customers don’t need to do anything.

Security firms roll out detections and mitigations

Palo Alto Networks says upcoming PAN-OS releases will address the issue, and it has shared workarounds and mitigations for customers to apply in the meantime. The company considers the impact on its products high severity, with a CVSS score of 8.7, and says it has no knowledge of attacks against them.

Fortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted. It is still investigating several others.

Sophos found that its MyUTM portal, a legacy licensing service it hosts for the end-of-life SG UTM product, was running a vulnerable PHP version. The company took the portal offline on October 21 and is updating it before bringing it back.

Broadcom says it has not confirmed any of its Enterprise Security Group products as affected. Its Symantec and Carbon Black offerings provide behavior-based signatures, a file-based detection for related hacking tools, and four application control rules for spotting activity potentially tied to PHP2Shell attacks.

CrowdStrike says it confirmed through testing that one unauthenticated POST request is enough to make an Apache mod_php worker start a shell and execute a command chosen by the attacker, with no vulnerable application code required. It has added PHP2Shell detection content to Falcon Next-Gen SIEM.

Cyber insurer Coalition says it notified some policyholders it knew were running vulnerable PHP versions on October 20, ahead of public disclosure. Between October 20 and 21, its honeypots logged requests matching the patterns used to exploit the flaws.

Corelight, one of the organizations involved in the coordinated response, created Zeek and Suricata detections ahead of disclosure and made them available as open source. 

Qualys rolled out a mitigation that switches off PHP’s session upload-progress feature on affected hosts, and JFrog cautioned that fake PoCs appeared around the time of disclosure.

Datadog, Endor Labs, Huntress, Patchstack, Recorded Future, Sansec, SOCRadar and Tenable have also published technical analyses and remediation advice.

CISA called on organizations to patch right away, starting with internet-facing systems, and cautioned that PHP is frequently embedded in other software, so its presence may not be obvious. 

The UK’s NCSC says discovery efforts should cover every PHP installation, not just outdated ones, and that organizations should keep an eye out for updates from vendors of appliances and services that may ship with PHP. It also recommends hunting for backdoors that attackers may have planted before patches or mitigations were applied.

The Dutch NCSC is tracking potentially affected software that depends on PHP in a public GitHub repository.

CERT-EU urges organizations to update without delay and to isolate internet-facing applications until the fix has been applied and verified. In a joint statement with the European Commission, ENISA, Europol and the EU’s network of national incident response teams, it warned that products may be vulnerable even when PHP runs behind the scenes and isn’t obviously in use.

Canada’s Cyber Centre and Germany’s BSI have also issued alerts, both urging organizations to install the updates without delay.

Some organizations chose to go offline rather than stay exposed. According to Reuters, several government, school and hospital websites in Europe were taken down on October 21.

Related: ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets

Related: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7