Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP. Collectively referred to as PHP2Shell, these vulnerabilities can potentially allow an unauthenticated attacker to remotely execute code on a vulnerable system.
Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical) and affect PHP installations processing web requests.
Who may be affected?
Organizations should consider PHP 5.x, 7.x, and 8.x installations potentially affected, including legacy systems. Older PHP 5.x versions should not be assumed safe simply because they predate currently supported releases.
Potentially affected environments include:
- Public websites and web applications running PHP
- Microsoft IIS servers using PHP through FastCGI (php-cgi.exe)
- Apache, PHP-FPM, and other PHP web-serving environments
- Third-party applications or appliances that bundle PHP
- Development or test environments serving PHP applications including, but not limited to the following versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The presence of applications such as PhpStorm or PHP Manager for IIS does not by itself confirm vulnerability. The underlying PHP runtime and how it is being used must be evaluated.
What is Systems Engineering doing?
Systems Engineering is actively reviewing available telemetry across managed client systems to identify environments where vulnerable versions of PHP may be running.
Where our review identifies a client that may be affected, we will communicate directly with that client to validate the exposure and recommend appropriate next steps if needed.
Because PHP may also exist within systems outside our managed visibility, including externally hosted websites, third-party applications, appliances, or development environments, clients should also review these systems for PHP usage.
What should you do?
Identify and patch PHP installations immediately, prioritizing Internet-facing systems.
Supported PHP branches should be upgraded to at least:
For PHP 8.1 and older, verify whether the operating system, hosting provider, or application vendor has released a documented backported fix covering both CVEs. Otherwise, migration to a supported PHP version should be prioritized.
For vulnerable systems that were exposed to the Internet, organizations should also review available security telemetry for suspicious PHP activity, unexpected shell or process creation, downloads, and other indicators of compromise.
Our Recommendation
Identify → Patch → Verify → Investigate
Systems Engineering clients who would like additional assistance in identifying potentially vulnerable PHP use in your supply chain or have questions about a system that may be affected, should reach out to our Client Service team at customerservice@systemsengineering.com to create a service request.
Clients who are already familiar with the potential uses of web-facing services (e.g., website hosting, cloud apps, etc.) not managed or monitored by Systems Engineering should contact those vendors directly. Systems Engineering is happy to assist as necessary in the patching process.
