About Remote Code Execution - PHP "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) vulnerabilities. PHP is a popular server-side programming language. The vulnerabilities, covered in the October Linux Patch Wednesday, allow unauthenticated remote code execution through specially crafted requests. CVE-2026-109618 is caused by improper OOM error handling, while CVE-2026-109619 is caused by a use-after-free vulnerability in PHP's global data structures. Exploitation can lead to system compromise, data theft, malware installation, and access to internal networks.

⚙️ The PHP Foundation had known about the root cause since 2024 but prioritized a fix only on August 11, 2026. Updates planned for October 22 were released a day early due to an embargo breach. Users should upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install patched Linux distribution packages. For unsupported branches, migration to a supported version is recommended. Meanwhile, restrict Internet access and apply configuration-based workarounds. For network devices, install vendor fixes or apply recommended mitigations.

Positive Technologies implemented protections using PT AF, PT NAD, and PT NGFW, and released detection rules for MaxPatrol VM.

🛠 GitHub hosts over 1,000 public PHP2Shell exploit repositories, but achieving RCE against a specific target remains difficult. Exploitation requires a tailored exploit compatible with the target's PHP build, SAPI, extensions, and runtime configuration.

👾 Both vulnerabilities were added to CISA KEV on October 26. Confirmed exploitation remains limited, mostly involving network devices.

On October 26, Dream Group reported attacks on Palo Alto Networks devices in the US, Japan, Taiwan, and South Korea. Attackers identified 240 targets among 19,000 devices and compromised 24 firewalls and one management server. Three reportedly belonged to US government infrastructure. The attacks exploited PHP2Shell and the Linux kernel LPE vulnerability Fragnesia (CVE-2026-46300). Attackers stole service account credentials, user and group lists, network configurations, and private keys.

On November 12, Check Point experts reported attacks against Security Gateway devices that had started on October 30. By exploiting PHP2Shell and the DynamicCLI LPE vulnerability (CVE-2026-123039), attackers gained initial access, escalated their privileges, and installed the TSGA backdoor along with its network component, TSProxy. During the destructive phase of the attacks, they also gained SSH access to a VMware ESXi host and executed the destroy_v6 wiper.

🌐 According to Censys data, 27 million PHP services exposed to the Internet remain unpatched. In addition, the vulnerabilities affect products from numerous vendors, including Palo Alto Networks, Check Point, Netgate, Coolify, and Cisco.