php2shell one week later: Why one exploit doesn’t work everywhere
Source Tenable Research
Mentioned vulnerabilities
End of life, no fix coming : replace or isolate affected systems; no fix will be released.
Data as of 30 Oct 2026, 03:35 UTC
Rated High by Threat Radar's AI analysis
- Patch
- None coming – the product is end of life
What to do
No fix will be released: the affected product is end of life. Replace it, or isolate it from untrusted networks until you can.
AI-suggested
Official patches for CVE-2026-109618 and CVE-2026-109619 were released by PHP on October 21, 2026. Organizations should apply these updates immediately, prioritizing internet-facing management interfaces, network appliances, and end-of-life PHP branches. Tenable Nessus and Tenable One Web App Scanning provide version-based detection since October 21. No action beyond patching is indicated by the vendor advisory. Monitoring for exploitation attempts is advisable but patching is the primary defense.
Description
php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.