Blog

Critical vulnerabilities in PHP: What you need to do

Two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), could allow an attacker to execute code on a web server without logging in. All PHP installations handling web traffic are affected. Update immediately, prioritising systems exposed to the internet.

• Five actions to prioritise
• Requirements for effective protection
• Suspect a breach?

_{^{Update 27 October 2026}}

Session upload progress: PHP recommends setting session.upload_progress.enabled=0 until the next regular bug-fix release, including on updated systems. The recommendation relates to a separate, less likely vulnerability, CVE-2026-115560. If you have already applied this setting, leave it in place.

PHP on Windows: Use the rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1. These also include a fix for a separate vulnerability in Brotli, CVE-2026-111497.

Vendors: Cisco has confirmed which products are affected, and Palo Alto Networks is releasing hotfixes for PAN-OS. See the sections below.

Exploitation: Cisco Talos reports exploitation attempts starting within hours of publication, primarily scanning activity.

-> PHP: guidance on session upload progress 

-> PHP: updated Windows packages

What happened?

PHP powers a large part of the web, from WordPress and Drupal to custom-built systems. On 21 October, the PHP project released emergency security updates for two critical vulnerabilities known as PHP2Shell. Details had leaked the previous day, ahead of the planned disclosure.

What is the risk?

An attacker can exploit the vulnerabilities through specially crafted HTTP requests to execute code without authentication. How easy this is to achieve depends on the environment. The code runs with the permissions of the web service. From there, an attacker could access data, passwords and keys handled by the service, and potentially move further into the environment.

How easy is it to exploit?

The vulnerabilities are in the PHP core itself, not in the application. PHP assesses the risk as highest for Apache with mod_php, where a demonstrated attack can be triggered before the application code runs. This means that having an up-to-date WordPress or Drupal installation is not sufficient if the underlying PHP version is vulnerable. Code claiming to exploit the vulnerabilities is already publicly available.

How serious is it?

Critical, with a CVSS score of 9.2. The vulnerable code has been present since PHP 5.4. Palo Alto Networks has identified more than 22 million exposed instances. Cisco Talos estimates that around half of all PHP systems are running unsupported versions.

Is it being exploited?

Cisco Talos and several other security companies are reporting exploitation attempts. So far, these have mainly involved scanning and uncoordinated attempts. CISA Known Exploited Vulnerabilities Catalog is an additional source of information. The absence of a vulnerability from the catalogue does not mean that it is not being exploited.

Update immediately. Do not wait for further information about attacks.

Summary
Vulnerabilities	CVE-2026-109618 (RCE via out-of-memory corruption), CVE-2026-109619 (RCE via stale global state)
Severity	Critical, CVSS v4.0 9.2 for both
Affected environments	PHP installations handling web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Highest risk for mod_php.
Fixed in	PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Exploitation	Exploitation attempts have been reported, mainly involving scanning. Refer to vendors’ assessments and the CISA KEV catalogue as additional sources.
Workaround	No complete workaround. Updating is the only reliable remediation.

Five actions to prioritise

1. Identify where you are running PHP
   Inventory web servers, applications, containers, hosting environments, appliances and third-party products with embedded PHP. PHP is often not visible in asset inventories. Document the version, exposure and responsible owner. Start with internet-facing and business-critical systems.
2. Update and verify
   Install a patched version from PHP or your vendor. Linux distributions and LTS providers received the patches in advance. Restart all PHP workers. Check the version in the environment that is actually serving web traffic, as the command-line version may refer to a different installation. If you are running PHP on Windows, install the packages with the -1 suffix and check the package version, as the PHP version itself remains unchanged.
3. Address unsupported versions
   PHP 8.1 and earlier no longer receive standard security updates from the PHP project. Upgrade, preferably to 8.4 or 8.5, as PHP 8.2 reaches end of life on 31 December 2026. If an immediate upgrade is not possible, ask your vendor for backported fixes and assign an owner and a deadline.
4. Limit exposure until the update is complete
   Remove unnecessary public access and isolate services that cannot be updated immediately. The PHP project describes temporary hardening measures that reduce certain attack vectors but do not provide complete protection. Setting session.upload_progress.enabled=0 alone is not a substitute for updating. However, PHP now recommends this setting even after updating, due to a separate attack vector (CVE-2026-115560). According to PHP, applications that never change session.serialize_handler at runtime can keep the feature enabled. Apply the setting in the server configuration and restart all PHP workers.
5. Monitor and investigate
   Look out for recurring PHP crashes, out-of-memory errors, unexpected processes, new executable files and unusual outbound connections. Retain logs from before the update as well.

See the Detect and investigate suspicious activity section below.

→ Read more: PHP project security advisory and technical instructions 

Compensating controls in the meantime

Patching takes time, particularly for older systems. In the meantime, IPS and virtual patching at the firewall can reduce the risk for published PHP applications. They are not a substitute for updating.

Palo Alto Networks

• Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 or later: Threat ID 543004, published on 20 October, ahead of the public release.
• Threat Prevention: Threat IDs 543004, 97622, 97623, 97624, 97625, 97643, 97647, 97649, 97652, 97653, 97656, 97657, 97658, 97659, 97662, 97663, 97664, 97670, 97671, 97672, 97673, 97674, 97676, 97677 and 97678. Requires Applications and Threats content version 9162, 9163, 9164 or later. The list is updated continuously, so refer to the advisory for the current version.

Cisco Secure Firewall

• Cisco Talos has published Snort rules with SIDs 67359, 67360 and 67375. According to Talos, the rules are also included in the Snort Community Ruleset. Check that the rules are installed, enabled and configured to block traffic in the policy inspecting traffic to the PHP application.
  
  → Cisco Talos: analysis and signature coverage

Requirements for effective protection

An enabled signature does not necessarily mean that the application is protected. Check the following:

• Traffic passes through inspection. Traffic to the application must pass through the firewall or rule where the protection is applied.
• Encrypted traffic is inspected. Without inbound TLS decryption, or inspection after TLS termination, the firewall cannot see the attack. Most web applications use HTTPS.
• Protection is blocking. The signatures must be enabled with the action set to block or reset in the profile or policy applied to the rule.
• Content is up to date. The content and rule versions must match those specified by the vendor.
• Effectiveness is verified. Check the logs to confirm that traffic is being inspected and that the correct security profile is being applied. The absence of signature matches does not in itself prove that the protection is working.

Vendors state that their protections provide coverage against the vulnerabilities. It is too early to say how comprehensive that protection is. Enable it, but continue patching.

Detect and investigate suspicious activity

Patching should be complemented by checking what may already have happened. Review web, PHP and endpoint logs, paying particular attention to:

• Unusual uploads and session data, such as suspicious multipart requests or PHP code and serialised data in uploaded filenames.
• Large POST requests followed by HTTP 500 responses, particularly when accompanied by PHP memory errors or recurring worker crashes.
• Unexpected processes launched by the web service, for example a web server or PHP process starting a command shell.

A single detection does not prove that a compromise has occurred. Correlate web traffic, error messages and process events for the same server and point in time.

Ready-made detections

Splunk has published detections for PHP2Shell covering web traffic, PHP memory errors and suspicious process activity. Check the data sources and adapt the rules before using them. Unit 42 has published queries for Cortex XDR and XSIAM. These detect suspicious activity from PHP processes more generally and are not specific to these vulnerabilities.

→ Splunk: PHP2Shell Analytic Story
→ Unit 42: analysis and queries

Indicators of compromise (IOCs)

Cisco Talos publishes IP addresses associated with observed exploitation attempts. The addresses change quickly, so use Talos’s current list as a complement to behaviour-based detection. A match should be investigated in context, and the absence of matches does not rule out a compromise.

→ Cisco Talos: Indicators of Compromise

Cisco & Palo Alto Networks

The vulnerabilities may also affect vendors’ own products. We are monitoring Cisco and Palo Alto Networks particularly closely. The vendors’ advisories are the source for the latest product status and are updated regularly.

Palo Alto Networks

PAN-OS på brandväggar och Panorama är berörda, i versionerna 10.2, 11.1, 11.2, 12.1 och 12.2. Palo Alto Networks har publicerat hotfixar för flera versioner och anger preliminära datum för resten. Se advisoryn för rätt uppgraderingsväg för er version. Prisma Access och Cloud NGFW påverkas inte.

Risken är högst om management-gränssnittet kan nås från internet. Så ska det aldrig vara. Begränsa åtkomsten till betrodda interna adresser, helst via en dedikerad jump host. För att Threat Prevention ska skydda brandväggens egen management-trafik krävs att trafiken routas via en dataplane-port, att certifikatet för inkommande management-trafik byts, att trafiken dekrypteras och att Threat Prevention aktiveras på den.

→ Read more: Palo Alto Networks Security Advisory

Cisco

Cisco har bekräftat att Expressway Series, Expressway Select Series, Duo Access Gateway och Ultra-Reliable Wireless Backhaul (URWB) är berörda. Duo Access Gateway är rättad i version 3.2.0. För Expressway anges version 15.5.21, ännu utan datum. För URWB anges version 27.1.1 (februari 2027), och där kräver angreppet administratörsinloggning. Workarounds finns för Expressway och URWB.

Bland annat Secure Firewall, ISE, Catalyst Center, Catalyst SD-WAN Manager, Meraki, Umbrella och Secure Access är bekräftat inte sårbara. ISE Portal Builder och ett antal andra produkter utreds fortfarande. För Splunk-produkter finns en separat advisory från Splunk.

→ Read more: Cisco Security Advisory

Suspect a breach?

Patching does not remove an attacker who has already gained access. Our Incident Response team can help investigate suspicious activity and contain the damage.

Update log

Date	Change
27 October 2026	Updated status for Cisco and Palo Alto Networks. Added information on session upload progress (CVE-2026-115560), Windows packages and exploitation attempts reported by Cisco Talos. Expanded list of Threat IDs. Added detection guidance and a reference to Talos IOCs.
22 October 2026	First published

Sources

• PHP: Security advisory, update now
• PHP: Informational advisory, session upload progress
• PHP: Updated Windows builds for Brotli security fix
• Palo Alto Networks Security Advisory CVE-2026-109618
• Unit 42 Threat Brief
• Cisco Security Advisory
• Cisco Talos: Two critical RCEs in PHP core
• Splunk Security Content: PHP2Shell
• CERT-EU Security Advisory 2026-018
• CISA Known Exploited Vulnerabilities Catalog

Have questions?

Get in touch. We’re here to help.

Contact us

About the author