Critical PHP RCE Vulnerabilities Highlight Risks of Running Unsupported Versions
Written by AI from the linked story. Not reviewed by an editor. How this works
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical remote code execution vulnerabilities scoring 9.2 on the CVSS scale, with active exploitation already confirmed in the wild by Cloudflare. Official patches were released for supported PHP branches (8.2–8.5), but organizations running older, unsupported PHP versions are left exposed with no upstream remediation path. This situation is alarmingly common — many production environments lag behind on runtime upgrades due to compatibility concerns, leaving them vulnerable to catastrophic attacks. The availability of third-party backported patches from vendors like Aikido underscores that patch management must extend beyond official vendor support lifecycles, especially for internet-facing workloads.
Tactical Insight
Immediate actions
- Upgrade PHP immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or deploy Aikido's pre-patched container images for unsupported versions.
- Conduct an emergency audit of all internet-facing services to identify any PHP instances still running end-of-life versions.
- Enable web application firewall (WAF) rules targeting PHP2Shell exploitation patterns as a temporary compensating control.
Long-term improvements
- Establish a formal end-of-life (EOL) software policy requiring migration plans before runtime versions lose upstream support.
- Maintain a continuously updated software inventory (SBOM) covering all runtime environments and container base images.
- Integrate automated dependency and runtime vulnerability scanning into CI/CD pipelines to catch vulnerable components before they reach production.
Detection measures
- Deploy runtime application self-protection (RASP) or anomaly-based detection to identify RCE exploitation attempts against PHP workloads.
- Centralize and monitor application and server logs for indicators of compromise consistent with remote code execution (e.g., unexpected process spawning, outbound connections from web server processes).