Vulnerability Response Point

When critical vulnerabilities hit, start here. Live research: know what’s at risk, what to patch, and how to stay protected as it unfolds

PHP2Shell has dominated security news this week, for good reason. Two critical flaws in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a web server without logging in. Details leaked before PHP could ship a fix, and exploitation began within hours of the October 21 patch. Since disclosure, Check Point Research has seen 10% of organizations worldwide impacted, with Europe at 14% and telecommunications at 20%.

Within hours, Exposure Management customers received alerts and a threat report in the platform. Customers with an affected internet-facing asset got an alert naming the asset, the PHP version it runs and both CVEs.

Customers running Agentic Exposure Validation (AEV) on a regular schedule got more than an alert. We ran a targeted AEV scan for CVE-2026-109618 against every monitored asset on a vulnerable PHP version, 3,080 assets in all. AEV confirmed exploitability on 113 of them, fewer than 4%, at roughly one in eight AEV customers. Those teams know exactly which servers an attacker can reach today and can patch those first.

Customers using Exposure Prioritization and Safe Remediation can also act on their existing controls. For example, if a Check Point Intrusion Prevention System (IPS) protection covering the exposure is inactive, you can move it to Detect from the remediation dashboard. Once you’ve confirmed it won’t disrupt production, you can move it to Prevent.

Recommended steps

Update to a fixed version (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35), restart PHP-FPM or the web server, and confirm the running version with php -v or phpinfo()

Check your Linux distribution or long-term support (LTS) vendor for updated packages. They received the patches in advance

Where patching has to wait, apply interim mitigations, such as taking internet-facing PHP applications offline or putting them behind access control, and schedule the update

Keep Check Point IPS updates on automatic, with new critical protections in Prevent mode. Our IPS, Web Application Firewall (WAF) and web shell guidance still applies

Hunt for signs of exploitation across the past 48 hours and keep monitoring. Look for PHP worker crashes, web server processes spawning shells, and new .php files in webroots

PHP2Shell Targeted Attack: Patching and Defenses

1 in 10 organizations worldwide has been impacted since disclosure, with Europe seeing more than twice the rate of other regions.

Patching PHP remains critical, while layers like Check Point WAF are already blocking observed attack attempts.

Tyler Carrigan breaks down what’s happening and what defenders should prioritize now!

How Check Point WAF Pre-emptively Blocked “PHP2Shell”

THE THREAT Two critical PHP flaws, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are each rated 9.2 out of 10 on the CVSS scale.

No password. No account. No user interaction. One crafted web request can let a stranger run code on your server and read memory that may hold passwords, tokens, and API keys.

PHP2Shell: Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Check Point Research The technical briefing. What’s confirmed, what’s still rumor, and what to do now: affected branches and fixed versions, where to find every PHP instance (it’s not just your web servers), hunting signals to watch for, and the IPS and WAF protections already available.

PHP2Shell: Log4Shell at AI Speed – A CISO’s Perspective

Alex Spokoiny, Chief Security & Trust Officer PHP2Shell is Log4Shell all over again, but faster. AI is shrinking the time from disclosure to working exploit. Check Point’s own CISO describes how his team responded in the first hours and lays out four capabilities that decide how quickly you can contain the one: knowing what you run and who owns it, finding weaknesses before attackers do, deploying protections early, and keeping infrastructure patchable.

PHP2Shell Update: One in Ten Organizations Impacted as Europe Bears the Brunt

Check Point Research The attack data. 10% of organizations worldwide have seen exploitation attempts since the leak, and Europe is at 14%. Hungary (38%), Denmark (32%) and Austria (28%) lead the country rankings, and telecom (20%) and education (18%) lead by industry. The post also explains why updating your CMS won’t close the gap and lists the signs that you may already be compromised.