How Cortex Cloud Protects Against PHP2Shell Vulnerabilities From Code to Cloud

Two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2 and could allow unauthenticated remote code execution (RCE). According to Palo Alto Networks Cortex Xpanse, telemetry, more than 22.6 million internet-exposed instances are potentially vulnerable.

Security patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. With proof-of-concept exploits already observed, organizations should immediately identify vulnerable installations, apply security updates and implement protections across code, pipelines and runtime environments.

Read the full Unit 42 Threat Brief for technical details and recommended protections.

On October 20, 2026, details of two critical vulnerabilities in PHP core surfaced publicly ahead of their scheduled disclosure. The PHP security team responded with an emergency release on October 21, addressing vulnerabilities that could allow attackers to execute arbitrary code remotely without authentication.

The vulnerabilities, collectively referred to as PHP2Shell, stem from flaws in PHP's memory management and request handling:

CVE-2026-109618 (RCE via out-of-memory corruption): Improper handling of out-of-memory conditions can leave request data partially initialized, potentially allowing attackers to execute arbitrary code.

CVE-2026-109619 (RCE via stale global state): Improper memory cleanup can leave references to freed memory, allowing subsequent requests to access stale data and potentially execute arbitrary code.

Unlike vulnerabilities in application frameworks or third-party dependencies, these flaws exist in PHP itself. Attackers do not necessarily need to exploit a vulnerability in the application running on top of PHP. In Apache deployments using mod_php, unauthenticated RCE has been demonstrated before application code even begins executing.

The scale of potential exposure is significant. Cortex Xpanse identified more than 22.6 million exposed instances potentially vulnerable to these CVEs. Given PHP's widespread adoption across web applications, content management systems and enterprise infrastructure, many organizations may have vulnerable installations they are not actively tracking.

As highlighted in Millions of PHP Instances Exposed: What Organizations Need To Do Right Now , the accelerating pace of vulnerability discovery and exploitation makes traditional patching cycles increasingly difficult to sustain. Organizations need continuous exposure assessment, proactive risk prevention and real-time protection to reduce their attack surface before threats can be exploited.

The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Specific exploit conditions may vary by deployment.

Organizations should assess exposure across:

Web applications: PHP-based applications, including WordPress, Drupal, WooCommerce and Adobe Commerce.

Container images: Images containing vulnerable PHP versions, including those already deployed in production.

CI/CD pipelines: Build processes that introduce vulnerable PHP runtimes into application images.

Legacy infrastructure: Servers running PHP 8.1 or older, which no longer receive regular security updates from the PHP project.

Organizations using unsupported PHP versions should check for vendor-provided security backports or migrate to supported versions.

Immediate Steps for Security Teams

Organizations should prioritize patching while implementing additional security controls to reduce exposure and prevent exploitation.

For organizations unable to patch immediately, the official PHP security advisories outline configuration-based mitigations. These measures can reduce exposure to specific attack paths but do not eliminate the vulnerabilities. Updating remains the only complete solution.

How Cortex Cloud Helps Protect Against PHP2Shell

Responding to PHP2Shell requires more than identifying vulnerable PHP installations. Security teams need to understand which assets are exposed, prioritize remediation based on risk and prevent vulnerable software from reaching production.

Introducing the PHP2Shell Security Advisor

To help customers quickly assess their exposure, Palo Alto Networks is introducing the PHP2Shell Security Advisor, a custom Cortex AgentiX agent designed to identify and prioritize risks associated with CVE-2026-109618 and CVE-2026-109619.

The agent searches across virtual machines, VM images, container workloads, container images and serverless functions to identify vulnerable assets. It provides a clear exposure assessment and prioritizes affected assets based on business criticality and risk.

Beyond identifying vulnerabilities, the agent checks whether affected assets have Cortex XDR agent protection and whether existing vulnerability policies have flagged the CVEs. It then recommends prioritized remediation actions and preventive guardrails across CI/CD pipelines and admission controls.

The agent operates in read-only mode, giving security teams actionable recommendations while maintaining full control over remediation and policy changes in the Cortex console.

Beyond this targeted assessment, Cortex Cloud connects application security, vulnerability management and runtime protection to help organizations continuously identify and prioritize risk, prevent known vulnerabilities from reaching production and protect applications already running in the cloud.

Prevent PHP2Shell from Reaching Production

PHP2Shell can be tracked through the Cortex Cloud Supply Chain Attacks Portal, giving security teams a centralized view of the threat, affected software versions and potential exposure across their environments.

Security teams can then enforce preventive policies through Cortex Cloud and its CI/CD integrations. With Cortex CLI, organizations can scan newly built container images for the affected CVEs and block builds that violate their vulnerability policies, preventing vulnerable PHP versions from reaching production.

Prioritize and Protect Vulnerable Workloads

Identifying vulnerable software in code is only part of the challenge. Organizations also need to understand where affected versions are already deployed and which assets face the greatest risk.

For workloads already running in production, Cortex Cloud Runtime, Cortex XDR and Cortex XSIAM provide multilayered protection against post-exploitation activity. Cortex Attack Surface Management helps identify exposed PHP installations that may otherwise go unnoticed, while Frontier Virtual Patching provides additional network-level protection against known exploitation attempts.

Cortex Exposure Management along with detections provided by Cortex Cloud, Cortex XDR and Cortex Network Scanner help to detect and prioritize vulnerable assets, including those that are on-prem or not exposed to the Internet. The precision filtering engine helps to reduce the alert fatigue and focus on what matters the most for the steps.

Together, these capabilities help organizations move beyond reactive vulnerability management to continuously identify, prioritize and prevent risk from code to runtime.

Beyond Patching: Preventing the Supply Chain Threat

PHP2Shell demonstrates how vulnerabilities in widely used software can create risk across millions of internet-facing systems.

Patching vulnerable PHP installations is the immediate priority, but organizations also need a sustainable approach to identifying and preventing these risks across their environments.

Cortex Exposure Management along with detections provided by Cortex Cloud, Cortex XDR and Cortex Network Scanner help to detect and prioritize vulnerable assets, including those that are on-prem or not exposed to the Internet. The precision filtering engine helps to reduce the alert fatigue and focus on what matters the most for the steps.

Protect your applications from emerging software supply chain threats with Cortex Cloud. Unify application security, vulnerability management and runtime protection to identify and prioritize risk, prevent vulnerable software from reaching production and continuously reduce risk from code to cloud.

Request a Demo to see how Cortex Cloud can help secure your applications and software supply chain.

Unit 42 Threat Brief: Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Millions of PHP Instances Exposed: What Organizations Need To Do Right Now

CVE-2026-109618: RCE via Out-of-Memory Corruption

CVE-2026-109619: RCE via Stale Global State

Get the latest news, invites to events, and threat alerts