Tech and Security Companies Respond to PHP2Shell Vulnerabilities

The PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are critical remote code execution flaws affecting PHP. They allow unauthenticated attackers to execute arbitrary code remotely. The vulnerabilities were discovered by Wiz, OpenAI, and Calif in August 2026 and publicly disclosed in October 2026. PHP released patches on October 21, 2026, for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploitation attempts were observed prior to the embargo lift and continued after patches were released. Multiple security companies and governments have issued advisories and detection rules. Vendors including Cisco, Red Hat, Ubuntu, Debian, AWS, Google Cloud, cPanel, Plesk, and others have reviewed or patched their products. Some organizations have taken offline affected services as a precaution. The vulnerabilities require precise heap manipulation and timing for reliable exploitation, but unauthenticated remote code execution is possible under certain conditions. Detection and mitigation tools have been rapidly deployed by security firms.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on affected PHP installations, potentially leading to full system compromise. Exploitation attempts have been observed in the wild, including mass exploitation shortly after patches were released. The vulnerabilities affect a wide range of PHP versions and, by extension, many commercial software products, appliances, and cloud services that embed PHP. This broad exposure increases the risk of compromise across diverse environments. Some vendors report that reliable exploitation requires non-default configurations or precise conditions, but unauthenticated code execution has been demonstrated in testing.

Official patches are available from PHP for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 and should be applied immediately. Organizations should identify and update all PHP installations, including those embedded in other software or appliances. Security firms have released detection signatures and mitigations; these should be deployed to detect and block exploitation attempts. Some vendors have provided product-specific advisories and workarounds. Organizations are advised to isolate internet-facing PHP applications until patches are applied and verified. Hunting for potential backdoors installed prior to patching is recommended. Some organizations have chosen to temporarily take affected services offline to reduce risk. Monitoring vendor advisories for updates is essential.