TL;DR: PHP2Shell comprises two critical vulnerabilities that can allow unauthenticated attackers to execute code on affected PHP installations. Security researchers have reported exploitation attempts, and the vulnerabilities may also expose sensitive information from PHP worker memory. Aquasec’s platform and services are not affected by PHP2Shell, but customers running PHP applications may have vulnerable workloads in their environments. Aquasec provides vulnerability detection and runtime controls to help identify exposure and restrict supported unauthorized activities while customers apply security updates.
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting the PHP runtime. Both carry a CVSS v4.0 severity score of 9.2 and can allow unauthenticated attackers to execute code on affected installations.
The vulnerabilities affect PHP itself rather than individual application code, meaning applications can be exposed even when their own code is secure. Affected web serving environments include PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP and LiteSpeed. Researchers identified Apache mod_php as a particularly high risk configuration because a demonstrated exploit can execute before application code runs.
The PHP project released the following fixed versions on October 21, 2026.
| PHP branch | Fixed version |
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
PHP 8.1 and older versions are no longer supported by the PHP project, although distribution vendors may provide security fixes through backported packages. Organizations should verify remediation with their relevant vendor rather than relying exclusively on the version string.
Why do the PHP2Shell vulnerabilities require immediate action?
Security researchers have reported attempts to exploit both PHP2Shell vulnerabilities. On October 21, watchTowr reported exploitation attempts targeting both CVEs, while Cloudflare reported attack traffic and attempts to adapt payloads to evade deployed firewall protections. At the time of those reports, no successful compromise of a specific server had been publicly confirmed.
The vulnerabilities also present a potential information disclosure risk. Researchers demonstrated that attackers may be able to read sensitive information from PHP worker memory without first achieving remote code execution. This information could include passwords, authentication tokens, API keys and other sensitive data associated with application activity.
The combination of potential code execution and memory disclosure makes rapid remediation important. Security teams need to identify affected PHP installations, apply security updates and verify that the corrected runtime is active.
AI assisted vulnerability research adds another consideration. Researchers reported using AI tools to help develop working exploits for longstanding PHP vulnerabilities, illustrating how quickly previously overlooked weaknesses can become actionable. Security teams need to reduce production exposure while remediation proceeds rather than depend entirely on patching timelines.
Is Aquasec affected by PHP2Shell?
Aquasec’s platform and services are not affected by CVE-2026-109618 or CVE-2026-109619. The concern for customers is whether PHP based applications running in their own environments contain vulnerable PHP installations.
Customers should review container images and running workloads to identify affected PHP versions, particularly in internet facing applications. The fact that Aquasec itself is not affected does not mean that applications protected by Aquasec are automatically free from the vulnerabilities.
Aquasec provides vulnerability detection to help customers identify affected images and runtime security controls that can reduce exposure to supported unauthorized activities while remediation is underway.
Why is vulnerability scanning alone insufficient?
Vulnerability scanning identifies affected software, but a finding does not mean the risk has been eliminated. Organizations must locate vulnerable images, update the PHP runtime, test application compatibility and redeploy corrected workloads.
Remediation can be more involved for applications that depend on older PHP releases or legacy components. During this process, vulnerable workloads may remain in production even when security teams know which systems require attention.
Runtime security provides an additional layer of control by restricting supported unauthorized actions inside running workloads. Aquasec vulnerability detection helps identify affected images, while runtime context helps teams prioritize those that are actively deployed.
Neither scanning nor runtime enforcement removes the underlying vulnerability. The objective is to identify exposure, restrict behaviors that runtime policies can control and complete remediation as quickly as possible.
How can runtime security reduce exposure to PHP2Shell?
Runtime enforcement can restrict behaviors attackers may attempt after gaining code execution, including launching unauthorized shells, executing newly introduced binaries or establishing prohibited outbound connections. These controls can limit an attacker’s actions even while the underlying PHP vulnerability remains present.
However, PHP2Shell demonstrates the boundaries of these protections. Memory disclosure may occur within an existing PHP worker without launching another process or introducing a new executable. Controls designed to restrict those activities do not necessarily prevent an attacker from reading sensitive process memory.
Runtime protection should therefore complement security updates. Organizations need to patch the vulnerable runtime while using enforcement to reduce exposure to supported attack behaviors during remediation.
How does Aquasec protect PHP workloads?
Aquasec enforces security policies inside running workloads, allowing security teams to restrict supported unauthorized actions without depending exclusively on vulnerability specific signatures.
Four runtime control areas are particularly relevant to PHP workloads.
Restrict unauthorized process execution. Runtime policies can restrict PHP workloads from launching unnecessary shells and download utilities such as `sh`, `bash`, `curl` and `wget`. This can interrupt certain attempts to execute additional commands or retrieve malicious payloads.
Prevent unauthorized executable changes. Aquasec Drift Prevention can block execution of executable files that were not present in the original container image. This helps restrict newly introduced malicious binaries, although it does not independently prevent a PHP script from running through the existing interpreter.
Restrict unauthorized network activity. Appropriate runtime network controls can restrict unnecessary outbound connections and help limit certain reverse shell activities or communication with attacker controlled infrastructure.
Protect application files. File integrity monitoring can detect unauthorized modifications to sensitive application directories. File modification restrictions can prevent changes when properly configured, including changes to PHP web roots where malicious scripts might be introduced.
The effectiveness of these controls depends on workload coverage, policy configuration and the attack technique. In enforcement mode, validated policies can block supported unauthorized actions. They should not be represented as complete protection against either PHP2Shell vulnerability, particularly the reported memory disclosure path.
How can Aquasec customers identify vulnerable workloads?
Aquasec provides vulnerability detection for CVE-2026-109618 and CVE-2026-109619 across supported PHP workloads, including container images using standard Linux distribution packages and official PHP images.
Customers should do a full scan of container images and review the associated running workloads to identify affected PHP installations. Combining vulnerability findings with workload context helps teams prioritize vulnerable images that are actively deployed, especially those supporting internet facing applications.
After patching, teams should rebuild affected images, redeploy them and rescan to verify remediation. Distribution specific security backports should also be considered when reviewing results.
For detailed guidance on identifying vulnerable workloads, configuring runtime controls and applying security updates, see the Aquasec Knowledge Base article.
What should organizations do now?
Organizations should prioritize five actions.
- Identify affected PHP installations. Inventory container images and running workloads, including legacy PHP releases and internet facing applications.
- Apply official security updates. Update the PHP runtime rather than only the application. Restart Apache, PHP-FPM and other long running PHP workers so the corrected runtime is active.
- Review runtime policies. Validate applicable controls in Audit mode where supported, review legitimate application behavior and move appropriate policies into Enforce mode.
- Full scan and verify remediation. Rebuild and redeploy corrected images, complete a full scan of workloads and confirm that fixed packages or runtimes are active. Consult distribution vendors about backported fixes where relevant.
- Use temporary mitigations only as a bridge. Review PHP’s official mitigation guidance if immediate updating is not possible. These measures reduce exposure to specific attack paths but do not replace patching.
Aquasec customers who need assistance reviewing their environment can contact their account team or open a support ticket through Aquasec Support Portal. For additional information, see the Knowledge Base article.
PHP2Shell reinforces the need to combine vulnerability detection, timely remediation and runtime control. Aquasec’s platform and services are not affected by these vulnerabilities, but customers running PHP applications should identify their exposure and apply the available fixes. Runtime enforcement provides an additional layer of protection while remediation proceeds, helping restrict supported unauthorized activity without suggesting that every exploitation path can be blocked.
No. Aquasec’s platform and services are not affected by CVE-2026-109618 or CVE-2026-109619. However, customers running PHP based applications may have vulnerable workloads within their environments.
Security researchers have reported exploitation attempts against both vulnerabilities. The reporting available on October 21, 2026, did not confirm a successful compromise of a specific server. Organizations should treat the vulnerabilities as urgent and apply official security updates.
Aquasec runtime enforcement can restrict supported unauthorized actions, including certain process execution, executable changes and network activity. These controls do not guarantee protection against every exploitation path or the reported memory disclosure risk.
No. Runtime enforcement can reduce exposure to certain attack behaviors while remediation is underway, but updating PHP remains necessary to fix the underlying vulnerabilities.
Aquasec customers should complete a full scan of updated container images and review workloads to confirm that fixed PHP packages or runtimes are deployed. They should also ensure that long running PHP workers have restarted and that no affected workloads remain in production.