Qualys Outlines Stopgap Defenses for PHP2Shell While Organizations Patch
Summary
Qualys recommends finding exposed PHP, disabling session upload progress, layering WAF/IPS/EDR controls, then patching and validating PHP2Shell. It reports 199,000 of 156 million installations patched in the first 12 hours; one customer probe validated 25 of 1,539 PHP -
Key points
- Qualys says only 199,000 of 156 million PHP installations with a known version were patched in the first 12 hours after disclosure.
- TruConfirm’s benign probe checks whether the tested PHP2Shell entry point is reachable and whether the upload-progress mitigation is absent; it does not create files or execute code.
- In one customer environment, TruConfirm returned positive validation results for 25 of 1,539 assets running PHP; Qualys says a negative result does not guarantee all exploitation paths are closed.
- Qualys’s configuration mitigation disables session upload progress and hardens related session handling to reduce exposure to the confirmed attack path, without application-code changes.
- The mitigation does not eliminate every exploitation path associated with CVE-2026-109618 and CVE-2026-109619; test applications that depend on upload progress and verify configuration and service restarts.
- Qualys recommends WAF/IPS signatures to block exploit requests and EDR policies to help stop post-exploitation actions, such as a web server process launching a shell.
- Qualys says updating PHP remains the only complete fix; restart PHP-loading services, verify patched workers, and repeat validation.
Article Details
- Defense Focus
- Reduce exposure to the PHP2Shell attack path while affected PHP installations are identified and patched, using configuration mitigation and layered network and endpoint controls.
- Detection Methods
- Use QID 45110, vulnerability-detection QIDs, and software inventory to find PHP installations and assess affected assets.
- Use TruConfirm's benign probe to check whether the tested PHP2Shell entry point is reachable and whether the upload-progress mitigation is absent; a negative result does not rule out all exploitation paths.
- Prioritize validated assets using internet exposure and business criticality.
- Use WAF and IPS signatures to identify or block exploit requests, and EDR behavioral policies to detect a web server process launching a shell or dropping a web shell.
- After mitigation or patching, verify the effective PHP configuration, installed package, running PHP worker build, and required service restarts.
- Data Sources
- Network scans, Cloud Agent assessments, container assessments, and Deep Scan results, where supported
- Qualys TotalAppSec assessments of exposed web applications and APIs
- PHP package and software-inventory data
- TruConfirm reachability and mitigation-validation results
- PHP configuration and service restart logs
- WAF and IPS request/signature events
- EDR process-behavior telemetry for web server processes
- Rule Types
- WAF signatures naming CVE-2026-109618 and CVE-2026-109619
- IPS signatures naming CVE-2026-109618 and CVE-2026-109619
- EDR behavioral policies for web server processes launching shells or dropping web shells
- Platforms
- Web application firewalls (WAF)
- Intrusion prevention systems (IPS)
- Endpoint detection and response (EDR)
- Agent-based and scanner-based assessment
- Defensive Actions
- Apply the Qualys configuration mitigation to disable session upload progress and harden related session handling; test applications that depend on upload-progress functionality.
- Verify the effective configuration after mitigation and confirm every affected PHP worker has loaded it; manually restart the service if needed.
- Keep applicable WAF, IPS, and EDR protections enabled and current, and verify endpoint policies fire for the PHP worker.
- Deploy the supported PHP or vendor patch, restart every service that loads PHP, and verify that running workers use the patched build.
- Repeat TruConfirm validation and configuration checks after mitigation and patching; continue tracking systems until patched.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe article identifies a web server process launching a shell as an attacker next step that EDR behavioral policies may help stop.T1505.003 · Web ShellThe article identifies dropping a web shell as an attacker next step that EDR behavioral policies may help stop.
CVE
CVE-2026-109618Select the WAF, IPS, and EDR you run to see the exact signatures and policies each vendor has released for CVE-2026-109618 and CVE-2026-109619, ready to copy into your console.CVE-2026-109619Select the WAF, IPS, and EDR you run to see the exact signatures and policies each vendor has released for CVE-2026-109618 and CVE-2026-109619, ready to copy into your console.
Vendors
AkamaiWAF and IPS vendors such as Akamai, Cloudflare, F5, Palo Alto Networks, Fortinet, and Check Point have released signatures that name both CVEs.Check PointWAF and IPS vendors such as Akamai, Cloudflare, F5, Palo Alto Networks, Fortinet, and Check Point have released signatures that name both CVEs.CloudflareWAF and IPS vendors such as Akamai, Cloudflare, F5, Palo Alto Networks, Fortinet, and Check Point have released signatures that name both CVEs.CrowdStrikeBehavioral policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.F5WAF and IPS vendors such as Akamai, Cloudflare, F5, Palo Alto Networks, Fortinet, and Check Point have released signatures that name both CVEs.FortinetWAF and IPS vendors such as Akamai, Cloudflare, F5, Palo Alto Networks, Fortinet, and Check Point have released signatures that name both CVEs.MicrosoftBehavioral policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.Palo Alto NetworksWAF and IPS vendors such as Akamai, Cloudflare, F5, Palo Alto Networks, Fortinet, and Check Point have released signatures that name both CVEs.QualysStep 2: Apply the Qualys Mitigation
Products
Cloud AgentsQualys customers can identify PHP installations through network scans, Cloud Agents, container assessments, and Deep Scan, where supported.Cortex XDRBehavioral policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.CrowdStrike FalconBehavioral policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.Deep ScanQualys customers can identify PHP installations through network scans, Cloud Agents, container assessments, and Deep Scan, where supported.Microsoft Defender for EndpointBehavioral policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense.PHPStep 1: Find and Prioritize Exposed PHPQualys ETMComing Next: Give Your Controls Credit in Qualys ETMQualys TotalAppSecAdditionally, they can assess exposed web applications and APIs using Qualys TotalAppSec.TruConfirmWAF, IPS, and EDR protections from major vendors add further layers, and TruConfirm shows which hosts are actually reachable: 25 of 1,539 in one customer environment.TruRisk Eliminatethe same mitigation script is available in the Custom Assessment and Remediation (CAR) library in TruRisk Eliminate and runs directly on scanner-based hosts.