PHP “php2shell” vulnerabilities: what defenders should do now

Two critical vulnerabilities in PHP have turned a routine patch cycle into an urgent security task. The PHP team released fixes on October 21, 2026, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. For security teams, the takeaway is straightforward: find every exposed PHP installation, verify its patch status, and investigate suspicious activity.

What happened?

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can allow remote code execution without authentication in affected PHP installations serving web requests. The PHP project identifies Apache with mod_php as a particularly high-risk configuration, and lists PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed among affected deployment types.

Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations using Linux distributions or long-term-support vendors should check their vendor’s security notice: a fix may be backported even if its package version doesn’t match the upstream number exactly. Older PHP branches may also have vendor-specific support, so verify rather than assuming.

CISA’s KEV listing raises the urgency. It is a practical signal for defenders to prioritize remediation, especially on internet-facing systems. Check the current CISA alert and PHP security guidance for updates before acting.

What should defenders do first?

1. Find PHP across the environment. Inventory web servers, containers, hosted applications, and third-party products that may bundle PHP. Don’t rely only on what teams remember deploying.
2. Prioritize systems exposed to the internet. Confirm the runtime and package source, then apply the fixed release or the vendor’s corresponding security update.
3. Treat workarounds as temporary. PHP says updating is the only complete fix. CISA notes a web application firewall may offer some protection while patching is underway, but it is not a substitute for remediation. If an affected system cannot be updated, follow CISA’s isolation guidance and the vendor’s instructions.
4. Check for signs of compromise. Review relevant logs and endpoint telemetry for unusual PHP worker behavior, including unexpected shell launches or tool downloads. If you find indicators, use your incident-response process rather than treating patching alone as proof the system is clean.
5. Verify and document. Confirm the patched version or vendor fix is active on every relevant worker and instance, record any exceptions, and set an owner and deadline for each remaining system.

The bigger security lesson

A critical vulnerability is also a test of basic security operations: asset visibility, patch prioritization, vendor coordination, monitoring, and incident response. Those habits matter whether the issue is in PHP, a cloud service, or a network appliance. Security+ learners encounter the same principles across vulnerability management and risk response: identify what is exposed, assess impact, choose a mitigation, and verify that it worked.

Preparing for Security+? Explore our CompTIA Security+ SY0-701 training. Want the updated SY0-801 prep? Subscribe for a launch notification; we’re working toward its release soon.

Security updates change quickly. This article reflects information available October 26, 2026. Follow the linked vendor and government advisories for the latest guidance.