Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP. Collectively referred to as PHP2Shell, these vulnerabilities can potentially allow an unauthenticated attacker to remotely execute code on a vulnerable system.
Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical) and affect PHP installations processing web requests.
Organizations should consider PHP 5.x, 7.x, and 8.x installations potentially affected, including legacy systems. Older PHP 5.x versions should not be assumed safe simply because they predate currently supported releases.
The presence of applications such as PhpStorm or PHP Manager for IIS does not by itself confirm vulnerability. The underlying PHP runtime and how it is being used must be evaluated.
Systems Engineering is actively reviewing available telemetry across managed client systems to identify environments where vulnerable versions of PHP may be running.
Where our review identifies a client that may be affected, we will communicate directly with that client to validate the exposure and recommend appropriate next steps if needed.
Because PHP may also exist within systems outside our managed visibility, including externally hosted websites, third-party applications, appliances, or development environments, clients should also review these systems for PHP usage.
Identify and patch PHP installations immediately, prioritizing Internet-facing systems.
For PHP 8.1 and older, verify whether the operating system, hosting provider, or application vendor has released a documented backported fix covering both CVEs. Otherwise, migration to a supported PHP version should be prioritized.
For vulnerable systems that were exposed to the Internet, organizations should also review available security telemetry for suspicious PHP activity, unexpected shell or process creation, downloads, and other indicators of compromise.
Systems Engineering clients who would like additional assistance in identifying potentially vulnerable PHP use in your supply chain or have questions about a system that may be affected, should reach out to our Client Service team at customerservice@systemsengineering.com to create a service request.
Clients who are already familiar with the potential uses of web-facing services (e.g., website hosting, cloud apps, etc.) not managed or monitored by Systems Engineering should contact those vendors directly. Systems Engineering is happy to assist as necessary in the patching process.