php2shell: Are your systems exposed to this critical CVE?

The php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated attackers to execute arbitrary code on exposed servers through memory corruption. Since public disclosure officially occurred on October 20, 2026, the technology sector has been racing to secure exposed infrastructure. At JILICC, maintaining rigorous platform integrity involves constantly monitoring threats exactly like this one, ensuring that backend systems remain entirely insulated as active exploitation continues in the wild.

Discovered initially on August 1, 2026, by researchers at Calif, OpenAI, and Wiz, the threat remained largely under the radar until Amazon Threat Intelligence identified an exploitation attempt in its telemetry on October 17. The severity of the flaw was immediately apparent. Both CVEs carry a CVSS v4.0 severity score of 9.2, while the v3.x score for CVE-2026-109618 reached a maximum of 9.8. By the time the United States Cybersecurity and Infrastructure Security Agency (CISA) added it to their Known Exploited Vulnerabilities Catalog in October, this phpvulnerability had become a primary focus for system administrators globally.

The operational fallout was swift and highly visible across multiple sectors. On October 21, 2026, major web services including DeviantArt, Pokémon Home, and Wikimedia infrastructure were temporarily taken offline for emergency maintenance. Government agencies in the Netherlands, Finland, and Denmark, alongside the Port of Rotterdam and multiple Dutch hospitals, temporarily took public websites down to mitigate risk. Security vendors were not spared; Sophos placed its MyUTM licensing portal offline that same day to apply security updates, later releasing intrusion prevention signatures for its firewall and endpoint customers on October 22.

The PHP Project responded rapidly, issuing emergency security patches at 14:00 UTC on October 21 and rolling out PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For systems that could not be patched immediately, the project published an advisory on October 23 recommending administrators disable session upload progress until the subsequent scheduled maintenance release.

Compounding the administrative burden is a parallel threat identified as HTTP2Shell (CVE-2026-111497), an out-of-bounds write defect in the Brotli decoder. When handling specifically crafted malicious compressed streams, it triggers memory corruption capable of elevating privileges or running remote code. This issue initially impacted Node.js and Python before extending to .NET and Windows versions of PHP. Microsoft pushed emergency updates for .NET 8.0 through 11, while PHP maintainers re-released Windows packages for versions 8.2 to 8.5 with a "-1" suffix to replace the compromised Brotli component.