PHP2Shell (CVE-2026-109618 & CVE-2026-109619): How to Identify and Fix vulnerable assets

Oct 21, 20264 min

What is PHP2Shell (CVE-2026-109618 & CVE-2026-109619)?

PHP2Shell refers to two distinct but related critical vulnerabilities in the PHP core:

CVE-2026-109618: Involves an out-of-memory (OOM) handling flaw where an interrupted request leaves internal data partially initialized. The resulting cleanup process can treat invalid data as valid, paving the way for Remote Code Execution (RCE).
CVE-2026-109619: Involves stale global state retention following fatal error handling. Internal state can survive after its backing memory is freed, allowing subsequent requests to use the stale state before it is reset, which can also be leveraged for RCE.

These vulnerabilities were disclosed earlier than intended, forcing PHP maintainers to accelerate an emergency out-of-band security patch.

Why are CVE-2026-109618 & CVE-2026-109619 critical?

Active Attacks Observed: Cloudflare has reported early in-the-wild attack attempts targeting these flaws.
Proof of Concept (PoC) Availability: Unverified PoC code is currently circulating publicly, dramatically lowering the barrier to entry for attackers.
Ubiquity of PHP: PHP powers a vast majority of the web, including Wordpress, the most popular CMS. The vulnerabilities impact major version lines, meaning the blast radius is exceptionally wide.
No Authentication Required: Unauthenticated attackers can trigger these flaws remotely to achieve code execution.

Which systems are affected/not affected by PHP2Shell?

Systems affected:

PHP core deployments across major version lines:

PHP 8: Versions below
PHP 8.5: Versions below 8.5.12,
PHP 8.4: Versions below 8.4.27,
PHP 8.3: Versions below 8.3.36,
PHP 8.2: Versions below 8.2.35,
PHP 5, 6, 7, and 8.1 and older.

Any web server or content management system relying on the affected PHP core versions.

Systems not affected:

Applications and web servers that do not process PHP.

How to Identify Affected Systems

Before you begin, run a global discovery to ensure you’re working with the most current data from your environment.

1: Using the Axonius AI Companion

Follow the steps in the video to identify vulnerable assets with PHP, broken by assets with public internet exposure and by hosting plane (cloud, on-prem, workstations, and remote).

Axonius AI Companion RCE on PHP

Prompts you can use:

Scoping vulnerable assets and building a dashboard:

Am I affected by CVE-2026-109618 or CVE-2026-109619?

Give me a dashboard with:

- 1 a breakdown of all servers affected and also which ones are publicly exposed to the internet.

- 2 then a breakdown of where they are hosted: cloud, on-prem, workstations, and remote.

If you don't find the CVEs, check for devices that are live and running PHP.

Mobilizing action:

Create a case for tracking resolution. Set <OWNER> as owner.

2: Using the Axonius MCP

To identify vulnerable assets with PHP, broken by assets with public internet exposure and by hosting plane (cloud, on-prem, workstations, and remote), use a similar prompt as the Axonius AI Companion. Replace building dashboards and mobilizing action with your harness systems of preference.

Am I affected by CVE-2026-109618 and CVE-2026-109619?

Using the Axonius MCP, give me:
Step 1: a breakdown of all servers affected and also which ones are publicly exposed to the internet.

Step 2: a breakdown of where they are hosted: cloud, on-prem, workstations, and remote.

Give direct answers straight from Axonius data. Avoid other MCPs given their data are already correlated in Axonius and to keep inference costs low/results deterministic.

3. Using Axonius Queries

To identify instances of PHP2Shell:

Already identified by your vulnerability scanners or CNAPP solutions: go to Assets > Exposures > Aggregated Security Findings and search for findings with the CVEs: CVE-2026-109618 or CVE-2026-109619.
Not identified by your vuln scanners, but presence: Because vulnerability scanners might lag behind emergency disclosures, proactively hunt for devices running PHP. Go to Assets > Compute > Devices, and search for systems running installed PHP software (Software Name containing PHP or php)
Publicly exposed to the internet: To identify publicly exposed servers running PHP, expand the query from step 2 including the fields Public IP exists or Internet Exposure = Inbound Exposed or Inbound Partially Exposed.

How to remediate and mitigate PHP2Shell

Apply the Emergency Patch: The absolute priority is to apply PHP's emergency security release. As of Oct-21, 12:00 pm ET, the php.net released emergency updates to PHP versions 8.2 and above, alongside source backports for previous versions.
Monitor Web Application Firewalls (WAF): Until patches are applied, monitor your edge defenses. Providers like Cloudflare may offer interim WAF rules to detect or drop attack attempts.
Take Critical Systems Offline if Unpatchable: If you cannot patch internet-facing, mission-critical applications immediately, consider taking them offline temporarily, as advised by some national cyber security centers.

Additional PHP2Shell resources and advisories

Get Started

See how to make asset intelligence actionable with a guided demo:

Stop chasing data — work from one asset model your entire team can trust.
See what's exposed before it's a problem — surface coverage gaps automatically.
Turn alert noise into action — cut thousands of alerts down, to the ones that matter.