Vendors and Agencies Issue Fixes and Warnings for Critical PHP2Shell Flaws
Summary
PHP fixed two critical PHP2Shell flaws that enable unauthenticated remote code execution. Vendors and agencies are assessing exposure, issuing patches and detections, and advising organizations to update; exploitation attempts were observed before and after disclosure.
Key points
- CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution; PHP released fixes on October 21 for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- PHP issued the fixes a day ahead of planned disclosure after the CVE identifiers circulated online on October 20.
- Amazon reported an exploitation attempt on October 17. Several security firms detected attempts around the patch release, and WatchTowr observed mass exploitation soon afterward; circulating proof-of-concept exploits reportedly did not achieve code execution.
- Cisco listed more than 30 products and services under review and said none were known to be affected; vendors including Ubuntu, Debian, AWS, cPanel, Plesk, and DirectAdmin reported fixes or updates.
- Sophos took its vulnerable MyUTM portal offline on October 21 for updates. SolarWinds said it applied compensating controls to PHP-based services.
- Security companies released detection content and mitigations; CrowdStrike reported that one unauthenticated POST request can trigger a shell through Apache mod_php.
- CISA and other government agencies urged prompt patching and checks for PHP embedded in software; some government, school, and hospital websites in Europe were reportedly taken offline.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Severity
- Critical; NVD scores the flaws 9.8, while Red Hat scores them 8.1.
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable PHP’s session upload-progress feature on affected hosts.
- Isolate internet-facing applications until the fix has been applied and verified.
MITRE ATT&CK
T1059.004 · Unix ShellCrowdStrike reported that an unauthenticated POST request could make an Apache mod_php worker start a shell and execute an attacker-chosen command.T1190 · Exploit Public-Facing ApplicationUnauthenticated attackers sent requests exploiting the PHP vulnerabilities to achieve remote code execution.
CVE
Vendors
AmazonAmazon says the first exploitation attempt came on October 17, before the embargo lifted.BroadcomBroadcom says it has not confirmed any of its Enterprise Security Group products as affected.CiscoCisco’s advisory names over 30 products and cloud services under review. Among them are Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Webex and the AppDynamics PHP Agent.CoalitionCyber insurer Coalition says it notified some policyholders it knew were running vulnerable PHP versions on October 20, ahead of public disclosure.CorelightCorelight, one of the organizations involved in the coordinated response, created Zeek and Suricata detections ahead of disclosure and made them available as open source.cPanelAmong hosting control panels, cPanel, Plesk and DirectAdmin shipped patches.CrowdStrikeCrowdStrike says it confirmed through testing that one unauthenticated POST request is enough to make an Apache mod_php worker start a shell and execute a command chosen by the attacker, with no vulnerable applicationDebianOn October 21, Ubuntu shipped fixes for all its supported releases, and Debian addressed the flaws in its bookworm and trixie releases.DirectAdminAmong hosting control panels, cPanel, Plesk and DirectAdmin shipped patches.FortinetFortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted.GoogleGoogle Cloud itself is not vulnerable, but supported PHP runtimes in the App Engine standard environment were updated automatically, and new base images are being rolled out for the company’s serverless PHP services.JFrogQualys rolled out a mitigation that switches off PHP’s session upload-progress feature on affected hosts, and JFrog cautioned that fake PoCs appeared around the time of disclosure.Palo Alto NetworksPalo Alto Networks says upcoming PAN-OS releases will address the issue, and it has shared workarounds and mitigations for customers to apply in the meantime.PHPWiz, OpenAI and Calif identified them in August, and PHP addressed them on October 21 with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.PleskAmong hosting control panels, cPanel, Plesk and DirectAdmin shipped patches.QualysQualys rolled out a mitigation that switches off PHP’s session upload-progress feature on affected hosts, and JFrog cautioned that fake PoCs appeared around the time of disclosure.Red HatRed Hat’s assessment is less severe than NVD’s: it scores both bugs 8.1, compared with 9.8, and doesn’t rate them critical.SolarWindsSolarWinds says it has reviewed its products and internet-facing assets.SophosSophos found that its MyUTM portal, a legacy licensing service it hosts for the end-of-life SG UTM product, was running a vulnerable PHP version.UbuntuOn October 21, Ubuntu shipped fixes for all its supported releases, and Debian addressed the flaws in its bookworm and trixie releases.
Products
Amazon LightsailAWS is addressing the PHP2Shell vulnerabilities in Elastic Beanstalk, WorkMail, Amazon Linux, and Amazon Lightsail.Amazon LinuxAWS is addressing the PHP2Shell vulnerabilities in Elastic Beanstalk, WorkMail, Amazon Linux, and Amazon Lightsail.Apache mod_phpsays it confirmed through testing that one unauthenticated POST request is enough to make an Apache mod_php worker start a shell and execute a command chosen by the attacker, with no vulnerable applicationApp EngineGoogle Cloud itself is not vulnerable, but supported PHP runtimes in the App Engine standard environment were updated automatically, and new base images are being rolled out for the company’s serverless PHP services.CrowdStrike Falcon Next-Gen SIEMIt has added PHP2Shell detection content to Falcon Next-Gen SIEM.Elastic BeanstalkAWS is addressing the PHP2Shell vulnerabilities in Elastic Beanstalk, WorkMail, Amazon Linux, and Amazon Lightsail.FortiAnalyzerFortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted.FortiManagerFortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted.FortiOSFortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted.FortiWebFortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted.MyUTMSophos found that its MyUTM portal, a legacy licensing service it hosts for the end-of-life SG UTM product, was running a vulnerable PHP version.PAN-OSPalo Alto Networks says upcoming PAN-OS releases will address the issue, and it has shared workarounds and mitigations for customers to apply in the meantime.PHPWiz, OpenAI and Calif identified them in August, and PHP addressed them on October 21 with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.SG UTMSophos found that its MyUTM portal, a legacy licensing service it hosts for the end-of-life SG UTM product, was running a vulnerable PHP version.WorkMailAWS is addressing the PHP2Shell vulnerabilities in Elastic Beanstalk, WorkMail, Amazon Linux, and Amazon Lightsail.
Tools
SnortCisco Talos has outlined the Snort coverage for PHP2Shell, including Community Ruleset rules.SuricataCorelight, one of the organizations involved in the coordinated response, created Zeek and Suricata detections ahead of disclosure and made them available as open source.ZeekCorelight, one of the organizations involved in the coordinated response, created Zeek and Suricata detections ahead of disclosure and made them available as open source.