PHP2Shell: You Can't Patch What You Don't Know You Run
Updated: 7 days ago
ok so PHP2Shell is this week's bad news, and the real lesson isn't about PHP.
It's about one question most teams can't answer fast: do we even run that?
What happened
Two flaws in PHP core, CVE-2026-109618 and CVE-2026-109619.
Both are unauthenticated remote code execution bugs, meaning a stranger on the internet can run commands on your server without logging in. CVSS 9.2, so near the top of the scale.
The timeline:
Oct 17: Amazon saw probing, four days before disclosure.
Oct 21: PHP shipped fixes (8.5.12, 8.4.27, 8.3.36 and 8.2.35).
Oct 24: a researcher confirmed working RCE on honeypots.
Oct 26: CISA put both on its Known Exploited list, with a federal deadline of Oct 29.
If you run PHP 8.1 or older, there is no upstream fix coming, so you need an upgrade plan.
Why you can't just say we're fine
PHP runs roughly 70% of websites, and Censys counts 32.5 million PHP services on affected versions.
But the sneaky part is where it hides. Appliance management consoles, NAS panels, printers.
That firewall admin page you log into once a quarter? Might be PHP under the hood.
That's why the vendor list is so long. Palo Alto, Cisco and Fortinet all have advisories, and those lists are still changing as of Oct 26.
Check the advisory itself, not a screenshot from someone's feed.
What to do this week
Make a list of everything you manage that has a web login. Firewalls, VPN gateways, NAS boxes, printers, backup tools. Include the thing someone set up three years ago and forgot.
Find out which of those are reachable from the internet. A management page open to the whole world is the real risk.
Lock management interfaces to trusted IPs today. It's the fast win and it helps before any patch lands.
Patch the internet-facing stuff first, then work inward, and read each vendor's advisory. Not listed doesn't always mean safe, since some lists are still under review.
Don't panic at every weird log line
Exploitation is confirmed. Reliability is a different story.
VulnCheck says most public proof-of-concept code doesn't work, and the honeypot demo ran on a friendly single-worker setup.
So expect noisy logs for a while. That doesn't mean you got popped. It means somebody is knocking, and your job is making sure the door is shut.
You can't patch what you don't know you run. Make the list first.
Comments