CVE-2026-109618 & CVE-2026-109619: PHP2Shell Detection and Remediation Guide

If you are reading this and your organization runs PHP — and statistically, it does — you have a problem that demands immediate attention. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, represent critical remote code execution flaws in one of the most pervasive technologies on the internet. PHP powers more than 70% of websites worldwide, from enterprise CMS platforms to custom internal applications, API backends, and legacy systems nobody wants to touch.

This is not a theoretical risk. When critical RCE vulnerabilities surface in PHP, attackers move fast. We have seen this pattern before with every major PHP vulnerability disclosure: within hours of public details emerging, automated scanning begins, exploit frameworks integrate PoC modules, and mass exploitation follows. The window between disclosure and weaponization for PHP vulnerabilities has historically been measured in days — sometimes hours.

This post provides the technical breakdown, detection logic, and remediation guidance your teams need to find PHP2Shell exposure across your environment and close it before threat actors find it for you.

Technical Analysis: Understanding PHP2Shell

Affected Technology and Scope

PHP2Shell refers to a pair of critical vulnerabilities in PHP that allow remote attackers to achieve command execution on the underlying server. The affected component is PHP itself — the server-side scripting engine embedded in web servers worldwide. This means the exposure surface includes:

Web servers running PHP via mod_php (Apache), PHP-FPM (Nginx/Apache), or CGI
CMS platforms including WordPress, Drupal, Joomla, and hundreds of others built on PHP
Custom web applications with PHP backends
API services using PHP frameworks like Laravel, Symfony, or CodeIgniter
Legacy internal applications that have been running unpatched PHP for years
Container images built on PHP base images that have not been rebuilt with patched versions

The sheer breadth of PHP deployment means that most organizations have PHP running in places they have forgotten about — development servers, staging environments, forgotten microsites, vendor appliances with embedded PHP, and container images that were built months ago and never updated.

How the Vulnerabilities Work

While the specific technical details of CVE-2026-109618 and CVE-2026-109619 are still being fully documented in public advisories, PHP2Shell-class vulnerabilities in PHP typically follow a well-understood attack pattern. Based on the naming convention and the nature of critical PHP RCE vulnerabilities, the attack chain generally involves:

Initial access via HTTP request: The attacker sends a crafted HTTP request to a PHP-enabled web server. This could be a GET or POST request to any PHP-handled endpoint.
Vulnerability trigger: The crafted input reaches the vulnerable PHP code path — whether through URL parameters, POST body data, HTTP headers, or file upload mechanisms.
Code execution: The vulnerability allows the attacker to execute arbitrary system commands in the context of the web server process (typically www-data, apache, nginx, or a dedicated PHP-FPM pool user).
Post-exploitation: With initial command execution established, the attacker typically deploys a web shell, downloads additional tooling, establishes persistence, and begins lateral movement or data collection.

The critical severity designation indicates these vulnerabilities likely require no authentication and no user interaction — the worst-case scenario for internet-facing systems.

Exploitation Status

Given the critical nature of these vulnerabilities and PHP's ubiquity, security teams should assume that:

Proof-of-concept exploitation is imminent or already occurring. PHP vulnerabilities of this severity class are rapidly weaponized.
Automated mass scanning for vulnerable PHP versions is likely already underway by both legitimate security researchers and threat actors.
Web shell deployment is the expected immediate post-exploitation activity, consistent with the "PHP2Shell" naming convention.
Ransomware groups and initial access brokers will incorporate these vulnerabilities into their toolkits if they have not already.

Treat this as an active-threat scenario. Do not wait for confirmation of in-the-wild exploitation before beginning remediation. The cost of patching is trivial compared to the cost of incident response.

Detection and Response

Identifying Vulnerable PHP Installations

Before you can remediate, you need to know where PHP is running and what version it is. This is where most organizations struggle — PHP is embedded everywhere, and shadow IT means your inventory is probably incomplete.

External Attack Surface Discovery: You need to identify every externally facing asset running PHP. This includes domains you know about and ones you have forgotten — subdomains, acquired company infrastructure, marketing microsites, and development servers accidentally exposed to the internet.

Internal Vulnerability Assessment: Scan your entire internal network for PHP installations. Pay special attention to:

Linux servers with PHP packages installed via apt, yum, dnf, or compiled from source
Windows servers running PHP with IIS
Docker containers and Kubernetes pods with PHP base images
Network appliances and management interfaces with embedded PHP
Development and staging environments that mirror production

Local Package Checks: The most reliable detection method is local package auditing. On Linux systems, check the installed PHP version directly against the patched version numbers published by PHP.net and your distribution vendor.

Detection: Hunting for Exploitation

While patching is the primary defense, your SOC should simultaneously hunt for indicators that exploitation has already occurred. PHP2Shell exploitation will generate observable artifacts at the web server and OS level.

Sigma Rules

The following Sigma rules target the most common observable behaviors associated with PHP RCE exploitation: web server processes spawning shell commands and PHP processes writing executable files to web-accessible directories.

YAML

---
title: PHP Web Server Process Spawning Shell Commands
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects PHP or web server worker processes spawning command shells, consistent with PHP2Shell remote code execution exploitation.
references:
  - https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-cgi'
      - '/php'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/ash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/wget'
      - '/curl'
      - '/id'
      - '/whoami'
      - '/uname'
      - '/cat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate PHP applications that shell out to system commands (e.g., image processing with exec())
  - Monitoring agents running under PHP-FPM pools
  - Laravel Artisan or Symfony console commands invoked via web-triggered queues
level: high
---
title: Webshell File Creation in Web-Accessible Directories
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects creation of PHP files in web-accessible directories by non-standard processes, consistent with webshell deployment following PHP2Shell exploitation.
references:
  - https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/'
      - '/opt/lampp/htdocs/'
      - '/home/*/public_html/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
  filter_legitimate:
    Image|endswith:
      - '/composer'
      - '/php'
      - '/dpkg'
      - '/apt'
      - '/apt-get'
      - '/rpm'
      - '/yum'
      - '/dnf'
      - '/git'
      - '/rsync'
      - '/cp'
      - '/mv'
      - '/tar'
      - '/unzip'
  condition: selection_path and selection_ext and not filter_legitimate
falsepositives:
  - Deployment pipelines writing PHP files
  - CMS auto-update mechanisms (WordPress, Drupal)
  - Developer activity via IDE-synced remote connections
level: high
---
title: PHP Process Network Connection to Non-Standard Port
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects PHP-FPM or web server processes making outbound network connections to non-standard ports, potentially indicating command-and-control communication or reverse shell activity following PHP2Shell exploitation.
references:
  - https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1572
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/php-fpm'
      - '/php-cgi'
      - '/php'
      - '/apache2'
      - '/httpd'
  selection_ports:
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 7777
      - 8888
      - 9999
      - 1337
      - 31337
      - 12345
      - 54321
  filter_common:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection_process and selection_ports and not filter_common
falsepositives:
  - Legitimate outbound API calls from PHP applications on non-standard ports
  - Database connections on non-standard ports
level: medium

KQL Hunting Queries (Microsoft Sentinel / Defender)

The following KQL queries are designed for environments ingesting Linux Syslog data via the Azure Monitor Agent or for Defender for Endpoint coverage on Linux servers. These queries hunt for the same behaviors described in the Sigma rules above.

KQL — Microsoft Sentinel / Defender

// Hunt 1: PHP/web server processes spawning suspicious child processes
// Requires Syslog or SecurityEvent ingestion from Linux web servers
Syslog
| where TimeGenerated > ago(72h)
| where ProcessName in~ ("php-fpm", "php-cgi", "php", "apache2", "httpd", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "/bin/dash", "/usr/bin/python", "/usr/bin/perl", "/usr/bin/wget", "/usr/bin/curl", "/usr/bin/nc ", "whoami", "/usr/bin/id", "uname -")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

// Hunt 2: Process execution telemetry — web servers spawning shells
// For Defender for Endpoint on Linux
DeviceProcessEvents
| where TimeGenerated > ago(72h)
| where InitiatingProcessFileName in~ ("php-fpm", "php-cgi", "php", "apache2", "httpd", "nginx")
| where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "wget", "curl", "nc", "ncat", "id", "whoami", "uname", "base64")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

// Hunt 3: Network connections from PHP processes to external IPs on suspicious ports
DeviceNetworkEvents
| where TimeGenerated > ago(72h)
| where InitiatingProcessFileName in~ ("php-fpm", "php-cgi", "php", "apache2", "httpd")
| where RemotePort in (4444, 5555, 6666, 7777, 8888, 9999, 1337, 31337, 12345, 54321)
| where not (RemoteIP startswith "10." or RemoteIP startswith "172.16." or RemoteIP startswith "192.168." or RemoteIP startswith "127.")
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Hunt 4: File creation events — PHP files written to web directories by unusual processes
DeviceFileEvents
| where TimeGenerated > ago(72h)
| where FolderPath has_any ("/var/www/", "/srv/www/", "/usr/share/nginx/", "/opt/lampp/htdocs/", "public_html")
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar"
| where InitiatingProcessFileName !in~ ("composer", "php", "dpkg", "apt", "apt-get", "rpm", "yum", "dnf", "git", "rsync", "cp", "mv", "tar", "unzip")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

Velociraptor VQL Hunt

For organizations running Velociraptor for endpoint forensics, the following VQL artifact hunts for evidence of PHP exploitation artifacts on Linux web servers.

VQL — Velociraptor

-- PHP2Shell Post-Exploitation Hunt
-- Identifies suspicious child processes of web server processes and webshell artifacts

-- Part 1: Check for suspicious processes spawned by web server parents
LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(sh|bash|dash|zsh|python|python3|perl|nc|ncat|wget|curl|id|whoami|uname|base64)$'

LET webserver_procs = SELECT Pid AS WebPid, Name AS WebName
FROM pslist()
WHERE Name =~ '(php-fpm|php-cgi|php|apache2|httpd|nginx)'

-- Part 2: Find suspicious child processes
SELECT suspicious_procs.Pid AS SuspiciousPid,
       suspicious_procs.Name AS SuspiciousProcess,
       suspicious_procs.CommandLine AS CommandLine,
       suspicious_procs.Username AS Username,
       suspicious_procs.CreateTime AS ProcessStartTime,
       webserver_procs.WebName AS ParentWebServer
FROM suspicious_procs
JOIN webserver_procs ON suspicious_procs.Ppid = webserver_procs.WebPid

-- Part 3: Hunt for recently created PHP files in web directories
LET webshell_hunt = SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=['/var/www/**/*.php', '/srv/www/**/*.php', '/usr/share/nginx/**/*.php', '/home/*/public_html/**/*.php'])
WHERE Mtime > now() - 86400 * 3
ORDER BY Mtime DESC

SELECT * FROM webshell_hunt

Remediation Script

The following Bash script identifies PHP installations, checks versions, and provides remediation guidance for common Linux distributions. Run this on every server in your environment.

Bash / Shell

#!/bin/bash
# ============================================================
# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Assessment Script
# Security Arsenal — Defensive Remediation Tool
# Run as root or with sudo on all Linux web servers
# ============================================================

echo "=============================================="
echo " PHP2Shell Vulnerability Assessment"
echo " CVE-2026-109618 / CVE-2026-109619"
echo " $(date)"
echo "=============================================="
echo ""

# --- 1. Detect installed PHP version ---
echo "[STEP 1] Detecting PHP installation..."
if command -v php &> /dev/null; then
    PHP_VERSION=$(php -v 2>/dev/null | head -1)
    echo "  FOUND: $PHP_VERSION"
    echo "  Path: $(which php)"
    echo ""
    echo "  PHP Binary Details:"
    php -v 2>/dev/null
    echo ""
else
    echo "  PHP CLI not found in PATH. Checking for PHP-FPM..."
fi

# Check for PHP-FPM
if command -v php-fpm &> /dev/null; then
    echo "  PHP-FPM detected: $(php-fpm -v 2>/dev/null | head -1)"
elif systemctl list-units --type=service 2>/dev/null | grep -q php; then
    echo "  PHP-FPM service detected:"
    systemctl list-units --type=service 2>/dev/null | grep php
fi

# Check for Apache mod_php
if command -v apache2 &> /dev/null || command -v httpd &> /dev/null; then
    echo ""
    echo "  Apache detected. Checking for mod_php..."
    if command -v apache2 &> /dev/null; then
        apache2 -M 2>/dev/null | grep -i php
    elif command -v httpd &> /dev/null; then
        httpd -M 2>/dev/null | grep -i php
    fi
fi

echo ""

# --- 2. Check package manager for PHP packages and available updates ---
echo "[STEP 2] Checking installed PHP packages..."

if command -v dpkg &> /dev/null; then
    echo "  Debian/Ubuntu system detected. Installed PHP packages:"
    dpkg -l | grep -E 'php[0-9]' | head -30
    echo ""
    echo "  Checking for available PHP updates..."
    apt list --upgradable 2>/dev/null | grep -i php
    echo ""
    echo "  To remediate, run:"
    echo "    sudo apt update && sudo apt upgrade -y php*"
    echo "    # Or for specific PHP version packages:"
    echo "    sudo apt update && sudo apt install --only-upgrade php8.3 php8.3-fpm php8.3-cli"

elif command -v rpm &> /dev/null; then
    echo "  RHEL/CentOS/Rocky/Alma system detected. Installed PHP packages:"
    rpm -qa | grep -i php | sort
    echo ""
    if command -v dnf &> /dev/null; then
        echo "  To remediate, run:"
        echo "    sudo dnf update php* -y"
    elif command -v yum &> /dev/null; then
        echo "  To remediate, run:"
        echo "    sudo yum update php* -y"
    fi
fi

echo ""

# --- 3. Check running PHP processes ---
echo "[STEP 3] Checking running PHP processes..."
ps aux | grep -E '[p]hp|[a]pache|[h]ttpd|[n]ginx' | head -20

echo ""

# --- 4. Check for Docker containers with PHP ---
echo "[STEP 4] Checking for Docker containers with PHP..."
if command -v docker &> /dev/null; then
    docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | while read -r name image; do
        if echo "$image" | grep -qi php; then
            echo "  PHP container found: $name (Image: $image)"
        fi
    done
    echo ""
    echo "  NOTE: Docker containers must be rebuilt with patched base images."
    echo "  Updating the host does NOT update containers."
    echo "  Check your Dockerfiles for php:* base images and rebuild."
else
    echo "  Docker not installed or not running."
fi

echo ""

# --- 5. Check for recently modified PHP files (potential webshells) ---
echo "[STEP 5] Scanning for recently modified PHP files in web directories..."
WEB_DIRS="/var/www /srv/www /usr/share/nginx /opt/lampp/htdocs"
for dir in $WEB_DIRS; do
    if [ -d "$dir" ]; then
        echo "  Scanning $dir (last 7 days)..."
        find "$dir" -name '*.php' -mtime -7 -type f 2>/dev/null | while read -r file; do
            echo "    MODIFIED: $file ($(stat -c '%y' "$file" 2>/dev/null | cut -d. -f1))"
        done
    fi
done

# Check home directories with public_html
for homedir in /home/*/public_html; do
    if [ -d "$homedir" ]; then
        echo "  Scanning $homedir (last 7 days)..."
        find "$homedir" -name '*.php' -mtime -7 -type f 2>/dev/null | while read -r file; do
            echo "    MODIFIED: $file ($(stat -c '%y' "$file" 2>/dev/null | cut -d. -f1))"
        done
    fi
done

echo ""

# --- 6. Check listening ports for web services ---
echo "[STEP 6] Checking web service listening ports..."
ss -tlnp 2>/dev/null | grep -E ':(80|443|8080|8443|9000|9001)\s' || \
    netstat -tlnp 2>/dev/null | grep -E ':(80|443|8080|8443|9000|9001)\s'

echo ""

# --- 7. Summary and recommendations ---
echo "=============================================="
echo " ASSESSMENT COMPLETE"
echo "=============================================="
echo ""
echo "NEXT STEPS:"
echo "  1. Compare your PHP version against the patched versions"
echo "     published by PHP.net and your distribution vendor."
echo "  2. Apply updates immediately using your package manager."
echo "  3. Rebuild any Docker containers with patched PHP base images."
echo "  4. Review any recently modified PHP files identified above."
echo "  5. Check web server access logs for suspicious requests."
echo "  6. Restart PHP-FPM / Apache / Nginx after patching."
echo ""
echo "REFERENCES:"
echo "  - Tenable Advisory: https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable"
echo "  - CVE-2026-109618"
echo "  - CVE-2026-109619"
echo ""

Using Tenable for PHP2Shell Discovery

For organizations running Tenable products, the platform provides multiple detection vectors for PHP2Shell:

Tenable One Attack Surface Management discovers externally facing PHP assets across your internet-facing infrastructure. This is critical for finding the shadow IT and forgotten servers that internal scans miss. If you have PHP exposed to the internet that you did not know about, this is where you find it — before attackers do.

Tenable One Vulnerability Management and Tenable Security Center provide vulnerability detections for CVE-2026-109618 and CVE-2026-109619, including local package checks for Linux distribution packages. These local checks are essential because they query the package manager directly for installed PHP versions rather than relying on banner grabbing or version inference, which can produce false negatives when servers are configured to suppress version information.

Tenable One Web App Scanning assesses web applications for PHP-related exposure, providing an application-layer view that complements infrastructure scanning. This is particularly valuable for identifying PHP applications behind reverse proxies, load balancers, and WAFs where direct infrastructure scanning may not reach the backend PHP engine.

The combined coverage across external attack surface, internal vulnerability assessment, and web application scanning provides the visibility needed to build a comprehensive remediation plan.

Remediation: Prioritized Action Plan

Immediate Actions (Next 24 Hours)

Inventory every PHP installation in your environment. Use the assessment script above, your vulnerability scanner, and your asset inventory. Do not rely on a single source — PHP is embedded in places you have forgotten about.
Identify internet-facing PHP assets. These are your highest priority. Any PHP installation reachable from the internet is a potential target for automated exploitation. Use external attack surface management tools and manual verification (check DNS records, cloud security groups, firewall rules).
Apply patches to internet-facing systems first. Update PHP to the fixed versions published by PHP.net and your Linux distribution vendor. On Debian/Ubuntu systems, run apt update && apt upgrade -y php*. On RHEL-based systems, run dnf update php* -y. Restart PHP-FPM, Apache, or Nginx after patching.
Verify patch application. After updating, confirm the running PHP version matches the patched version. Check both the CLI version (php -v) and the version served by your web server (create a temporary phpinfo() page or check response headers).
Rebuild container images. If you have Docker containers running PHP, patching the host does nothing for the containers. Update your Dockerfiles to use patched PHP base images and rebuild. Check for php:* base image references in all Dockerfiles and docker-compose files.

Short-Term Actions (Next 72 Hours)

Patch internal PHP installations. After internet-facing systems are secured, work through internal servers, development environments, and staging systems. Internal PHP can be exploited by attackers who have gained initial access through other vectors.
Deploy detection rules. Implement the Sigma rules and KQL queries provided above in your SIEM. Tune them for your environment — legitimate PHP applications that shell out to system commands will generate false positives that need to be filtered.
Review web server access logs. Look for suspicious request patterns in the days preceding and following the vulnerability disclosure. Search for requests with unusual parameters, encoded payloads, or requests to PHP files that should not exist.
Hunt for webshells. Run the file integrity checks and Velociraptor hunts described above across your web server fleet. Look for recently created or modified PHP files in web-accessible directories that do not match your deployment pipeline activity.

Longer-Term Hardening (Next 30 Days)

Implement PHP version management. Establish a policy for PHP version lifecycle management. Define which PHP versions are approved, set end-of-life dates, and automate upgrade pipelines. Organizations running end-of-life PHP versions (which no longer receive security patches) are carrying unacceptable risk.
Deploy Web Application Firewalls (WAFs). A properly configured WAF with rules targeting PHP exploitation attempts provides a virtual patching layer. This is not a substitute for patching, but it buys time when zero-day PHP vulnerabilities are disclosed.
Segment web servers. Web servers should be in a DMZ with restricted outbound network access. If a PHP vulnerability is exploited, network segmentation limits the attacker's ability to reach internal systems, databases, and domain controllers. PHP-FPM pool users should have minimal filesystem permissions.
Disable dangerous PHP functions. Where application requirements allow, disable exec(), shell_exec(), system(), passthru(), popen(), and proc_open() in php.ini. This will not prevent all exploitation, but it significantly raises the bar for post-exploitation command execution.
Establish continuous PHP monitoring. Add PHP version checking to your continuous vulnerability management program. PHP releases security updates regularly, and organizations need a repeatable process for applying them — not just when a named vulnerability makes headlines.

Vendor and Official References

Tenable PHP2Shell Advisory: https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable
CVE-2026-109618: Monitor NVD and CISA KEV for updated CVSS scoring and exploitation status
CVE-2026-109619: Monitor NVD and CISA KEV for updated CVSS scoring and exploitation status
PHP.net Security Advisories: Check https://www.php.net/security for patched version numbers
Distribution Security Trackers: Check your Linux distribution's security tracker for backported patches (Debian Security Tracker, Ubuntu Security Notices, Red Hat Security Advisories)

CISA KEV Monitoring

Monitor the CISA Known Exploited Vulnerabilities catalog for the addition of CVE-2026-109618 and CVE-2026-109619. If added, federal agencies will have mandated remediation deadlines, and the inclusion serves as confirmation of active exploitation. Even for private-sector organizations, KEV inclusion should trigger an emergency patching response if not already completed.

The Bottom Line

PHP2Shell is a severity-class vulnerability event in the most widely deployed server-side technology on the internet. The defensive playbook is straightforward: find every PHP installation, patch it, hunt for signs of prior exploitation, and build the operational muscle to do this faster next time. The organizations that get breached from PHP2Shell will not be the ones that lacked the technical capability to patch — they will be the ones that did not know where PHP was running in their environment. Fix your visibility problem first, and the patching problem solves itself.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub