Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Overview

On October 20, 2026, the existence of two vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”), became public ahead of coordinated disclosure. Both can allow unauthenticated remote code execution with the privileges of the web server account, and are rated CVSS v4.0 9.2 (Critical). All PHP versions prior to the fixed releases listed under Remediation are affected. The PHP Project considers Apache mod_php deployments to be at highest risk; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected. Amazon Threat Intelligence has reported an exploitation attempt on October 17, 2026, before public disclosure, and other security vendors have since reported further exploitation attempts.

No action is required for Sophos products. Customers who run PHP in their own environments, or use third-party products that bundle PHP, should update as described under Remediation. Sophos Firewall and Sophos Endpoint customers can use IPS signatures released on October 22, 2026 to detect exploitation attempts; see Workaround.

Applies to the following product(s) and version(s)

No Sophos products are affected by these vulnerabilities. This advisory is published to help customers assess PHP deployments in their own environments.

Sophos-hosted services

The MyUTM portal, a legacy Sophos-hosted licensing service for end-of-life SG UTM, ran an affected PHP version. Sophos took the portal offline on October 21, 2026 and is updating it before restoring service. Sophos is reviewing the portal’s logs and has found no evidence of exploitation to date; the review is ongoing and Sophos will update this advisory if that changes. SG UTM customers who need licensing assistance while the portal is offline can contact Sophos Support.

Remediation

On October 21, 2026, the PHP Project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address both vulnerabilities. These updates are not installed automatically. Organisations running PHP must apply them, or the equivalent packages from their Linux distribution, hosting provider or appliance vendor. PHP 8.1 and earlier are end-of-life and remain vulnerable. The PHP Project has published source-only backports for 7.4, 8.0 and 8.1; no binary releases will be provided, and systems on these versions should be upgraded to a supported branch.

Identifying affected systems

• Inventory PHP from runtime evidence, not just asset records. Look for running processes named php, php-fpm, php-cgi and versioned variants (e.g. php8.3).
• Confirm the PHP version from the binary itself; install paths are only a clue.
• Include PHP bundled within third-party appliances and hosted services, and confirm patch status with those vendors.

Checking for signs of compromise

The PHP Project received the first reports of these issues on August 11, 2026, and exploitation attempts have been observed since at least October 17, 2026. As a precaution, Sophos recommends reviewing activity on exposed systems from August 1, 2026 onwards:

• Web and WAF logs: multipart/form-data POSTs to endpoints that do not normally accept uploads, and requests containing the PHP_SESSION_UPLOAD_PROGRESS field. Many CDN and access logs do not record request bodies; WAF or application-layer logs may be needed.
• PHP and web server error logs: spikes in memory-exhaustion errors or worker crashes (segmentation faults).
• Process activity: child processes spawned by PHP or web server processes. Baseline normal behaviour first, then investigate shells, scripting interpreters or download utilities.
• Web roots: newly created or modified PHP files that may indicate web shells.
• Network activity: outbound connections from PHP processes to unexpected destinations or ASNs.
• Authentication: successful administrative logins to affected applications since August 1, 2026.

Workaround

Where immediate updating is not possible, the following steps reduce exposure:

• Take internet-facing PHP applications offline, or place them behind network-layer authentication such as ZTNA.
• Where an application does not accept uploads, set file_uploads = Off, and reject multipart/form-data requests at the web server or WAF before they reach PHP.
• Apply the PHP Project’s interim mitigations: memory_limit=-1 (which prevents the out-of-memory condition used by CVE-2026-109618), session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0.
• Restart all PHP workers after any configuration change, and verify the effective settings from a live web request (for example phpinfo()), not the PHP CLI.

These measures address specific attack paths only. In-process protections, such as RASP or application-embedded WAF agents, may not prevent exploitation: on Apache mod_php, CVE-2026-109618 can be triggered by an unauthenticated request before any application code runs. This workaround is not a substitute for updating PHP.

Sophos Firewall and Endpoint IPS

Sophos has released IPS signatures for Sophos Firewall and Sophos Endpoint that detect attempts to exploit these vulnerabilities. They do not replace updating PHP.

Sophos Firewall Web Application Firewall (WAF) does not currently include protection specific to these vulnerabilities.

Related information

• https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
• https://www.php.net/archive/2026.php#2026-10-21-5
• https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
• https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-php-updates/
• https://www.cve.org/CVERecord?id=CVE-2026-109618
• https://www.cve.org/CVERecord?id=CVE-2026-109619
• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
• https://cert.europa.eu/publications/security-advisories/2026-018/
• https://github.com/NCSC-NL/php2shell