tl;dr
Two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2 and could allow unauthenticated remote code execution (RCE). According to Palo Alto Networks Cortex Xpanse, telemetry, more than 22.6 million internet-exposed instances are potentially vulnerable.
Security patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. With proof-of-concept exploits already observed, organizations should immediately identify vulnerable installations, apply security updates and implement protections across code, pipelines and runtime environments.
Read the full Unit 42 Threat Brief for technical details and recommended protections.
What Happened?
On October 20, 2026, details of two critical vulnerabilities in PHP core surfaced publicly ahead of their scheduled disclosure. The PHP security team responded with an emergency release on October 21, addressing vulnerabilities that could allow attackers to execute arbitrary code remotely without authentication.
The vulnerabilities, collectively referred to as PHP2Shell, stem from flaws in PHP's memory management and request handling:
- CVE-2026-109618 (RCE via out-of-memory corruption): Improper handling of out-of-memory conditions can leave request data partially initialized, potentially allowing attackers to execute arbitrary code.
- CVE-2026-109619 (RCE via stale global state): Improper memory cleanup can leave references to freed memory, allowing subsequent requests to access stale data and potentially execute arbitrary code.
Unlike vulnerabilities in application frameworks or third-party dependencies, these flaws exist in PHP itself. Attackers do not necessarily need to exploit a vulnerability in the application running on top of PHP. In Apache deployments using mod_php, unauthenticated RCE has been demonstrated before application code even begins executing.
The scale of potential exposure is significant. Cortex Xpanse identified more than 22.6 million exposed instances potentially vulnerable to these CVEs. Given PHP's widespread adoption across web applications, content management systems and enterprise infrastructure, many organizations may have vulnerable installations they are not actively tracking.
As highlighted in Millions of PHP Instances Exposed: What Organizations Need To Do Right Now, the accelerating pace of vulnerability discovery and exploitation makes traditional patching cycles increasingly difficult to sustain. Organizations need continuous exposure assessment, proactive risk prevention and real-time protection to reduce their attack surface before threats can be exploited.
Who Is Affected?
The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Specific exploit conditions may vary by deployment.
Organizations should assess exposure across:
- Web applications: PHP-based applications, including WordPress, Drupal, WooCommerce and Adobe Commerce.
- Container images: Images containing vulnerable PHP versions, including those already deployed in production.
- CI/CD pipelines: Build processes that introduce vulnerable PHP runtimes into application images.
- Legacy infrastructure: Servers running PHP 8.1 or older, which no longer receive regular security updates from the PHP project.
Organizations using unsupported PHP versions should check for vendor-provided security backports or migrate to supported versions.
Immediate Steps for Security Teams
Organizations should prioritize patching while implementing additional security controls to reduce exposure and prevent exploitation.
| Priority | Recommended Action |
|---|---|
| Immediate | Identify vulnerable PHP installations across repositories, container images, cloud workloads and servers. Prioritize internet-facing assets. |
| Immediate | Upgrade PHP to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply verified vendor backports. Restart affected PHP workers. |
| Immediate | Enable threat prevention protections to block known exploitation attempts while patching is underway. |
| High | Rebuild and redeploy affected container images and enforce pipeline policies to prevent vulnerable versions from reaching production. |
| High | Investigate potential compromise by reviewing suspicious PHP processes, unexpected shell execution, newly created PHP files and abnormal worker crashes. |
| High | Apply temporary mitigations when patching is not immediately possible and isolate unsupported installations until they can be remediated. |
For organizations unable to patch immediately, the official PHP security advisories outline configuration-based mitigations. These measures can reduce exposure to specific attack paths but do not eliminate the vulnerabilities. Updating remains the only complete solution.
How Cortex Cloud Helps Protect Against PHP2Shell
Responding to PHP2Shell requires more than identifying vulnerable PHP installations. Security teams need to understand which assets are exposed, prioritize remediation based on risk and prevent vulnerable software from reaching production.
Introducing the PHP2Shell Security Advisor
To help customers quickly assess their exposure, Palo Alto Networks is introducing the PHP2Shell Security Advisor, a custom Cortex AgentiX agent designed to identify and prioritize risks associated with CVE-2026-109618 and CVE-2026-109619.
The agent searches across virtual machines, VM images, container workloads, container images and serverless functions to identify vulnerable assets. It provides a clear exposure assessment and prioritizes affected assets based on business criticality and risk.
Beyond identifying vulnerabilities, the agent checks whether affected assets have Cortex XDR agent protection and whether existing vulnerability policies have flagged the CVEs. It then recommends prioritized remediation actions and preventive guardrails across CI/CD pipelines and admission controls.
The agent operates in read-only mode, giving security teams actionable recommendations while maintaining full control over remediation and policy changes in the Cortex console.
Beyond this targeted assessment, Cortex Cloud connects application security, vulnerability management and runtime protection to help organizations continuously identify and prioritize risk, prevent known vulnerabilities from reaching production and protect applications already running in the cloud.
| Where | Cortex Capability | How It Helps |
|---|---|---|
| Code & Repositories | Supply Chain Attacks Portal | Tracks PHP2Shell, identifies vulnerable PHP versions and helps security teams understand which assets are affected. |
| CI/CD Pipelines | Cortex CLI & Pipeline Enforcement | Scans container images for vulnerabilities and enforces policies to block affected builds before they reach production. |
| Cloud & Container Images | Cortex Cloud Vulnerability Management | Detects vulnerable PHP versions across code, cloud environments and container images to help teams identify exposure and prioritize remediation. |
| External Attack Surface | Cortex Attack Surface Management | Discovers internet-exposed PHP installations and alerts security teams through the PHP Attack Surface Rule. |
| Servers & Endpoints | Cortex XDR & Cortex Exposure Management (Network Scanner) | Identifies vulnerable PHP packages across servers and endpoints, provides software inventory visibility and helps detect and prevent post-exploitation activity. |
| Cloud Runtime | Cortex Cloud Runtime & Cortex XSIAM | Helps detect and respond to post-exploitation activity through multilayered security protections. |
| Network | NGFW with Advanced Threat Prevention Plus | Helps block exploitation attempts through Frontier Virtual Patching, including Threat ID 543004, available since October 20, 2026. |
Prevent PHP2Shell from Reaching Production
PHP2Shell can be tracked through the Cortex Cloud Supply Chain Attacks Portal, giving security teams a centralized view of the threat, affected software versions and potential exposure across their environments.
By connecting supply chain threat intelligence with code-to-cloud visibility, Cortex Cloud helps organizations identify vulnerable components and determine which applications need attention.
Security teams can then enforce preventive policies through Cortex Cloud and its CI/CD integrations. With Cortex CLI, organizations can scan newly built container images for the affected CVEs and block builds that violate their vulnerability policies, preventing vulnerable PHP versions from reaching production.
Prioritize and Protect Vulnerable Workloads
Identifying vulnerable software in code is only part of the challenge. Organizations also need to understand where affected versions are already deployed and which assets face the greatest risk.
For workloads already running in production, Cortex Cloud Runtime, Cortex XDR and Cortex XSIAM provide multilayered protection against post-exploitation activity. Cortex Attack Surface Management helps identify exposed PHP installations that may otherwise go unnoticed, while Frontier Virtual Patching provides additional network-level protection against known exploitation attempts.
Cortex Exposure Management along with detections provided by Cortex Cloud, Cortex XDR and Cortex Network Scanner help to detect and prioritize vulnerable assets, including those that are on-prem or not exposed to the Internet. The precision filtering engine helps to reduce the alert fatigue and focus on what matters the most for the next steps.
Together, these capabilities help organizations move beyond reactive vulnerability management to continuously identify, prioritize and prevent risk from code to runtime.
Beyond Patching: Preventing the Next Supply Chain Threat
PHP2Shell demonstrates how vulnerabilities in widely used software can create risk across millions of internet-facing systems.
Patching vulnerable PHP installations is the immediate priority, but organizations also need a sustainable approach to identifying and preventing these risks across their environments.
Cortex Exposure Management along with detections provided by Cortex Cloud, Cortex XDR and Cortex Network Scanner help to detect and prioritize vulnerable assets, including those that are on-prem or not exposed to the Internet. The precision filtering engine helps to reduce the alert fatigue and focus on what matters the most for the next steps.
By connecting application security, vulnerability management and runtime protection, Cortex Cloud helps organizations continuously identify, prioritize and remediate risk from code to cloud, while preventing known vulnerabilities from reaching production.
Learn More
Protect your applications from emerging software supply chain threats with Cortex Cloud. Unify application security, vulnerability management and runtime protection to identify and prioritize risk, prevent vulnerable software from reaching production and continuously reduce risk from code to cloud.
Request a Demo to see how Cortex Cloud can help secure your applications and software supply chain.