Security advisory · 22 October 2026
PHP2Shell mitigation guide
What to patch, what to block at the edge, what to change on the host, and how to check whether you were hit. For teams running PHP in production.
PHP2Shell in three lines
- What it is. Two remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, each scored CVSS v4.0 9.2. A single unauthenticated request can run code on the server. Exploitation in the wild was reported on 21 October 2026.
- Who is exposed. Apache mod_php is at highest risk: the exploit fires before any application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected, and so are appliances, CMS platforms and container images that bundle a vulnerable PHP build.
- Fixed versions. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Restart PHP-FPM or Apache after patching so the fixed code is loaded.
The guide covers managed WAF rules by provider, custom edge rules, host settings and where they must live, reverse-proxy and sandbox controls, options for unsupported versions, and the compromise checks.
Sources: PHP security release, 21 October 2026; Help Net Security, 21 October 2026; watchTowr; Armis.
How Epiphyte can help
Exposure check
Inventory of PHP across servers, appliances, CMS and containers; versions and SAPIs; internet exposure; priority list.
Patch and hardening verification
Confirmation that fixed code is running, WAF and host settings are in the right place, and the edge, proxy and sandbox controls in the guide are applied where they fit.
Compromise assessment
Memory and log review on suspected hosts, hunt back to before 20 October, findings and containment steps.