Two critical vulnerabilities in the PHP runtime have put security teams on alert, prompting cybersecurity vendors to issue threat advisories, update protective measures and urge organisations to patch affected systems without delay.
Known collectively as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 are remote code execution vulnerabilities rated 9.2 under CVSS 4.0. They affect PHP itself rather than a particular website platform or plug-in, potentially exposing a broad range of applications running on vulnerable servers.
The response from major cybersecurity vendors highlights three parallel concerns: the scale of internet-facing exposure, the speed at which attackers are attempting to exploit the flaws, and the ability of security products to provide protection while organisations work through remediation.
Palo Alto Networks reports AI-assisted attack activity
Palo Alto Networks’ Unit 42 threat intelligence team has observed proof-of-concept exploits and reported post-exploitation activity involving an agentic AI attack platform.
In its October 23 threat brief, Unit 42 described an attack against a European government entity in which attackers accessed password hashes and multi-factor authentication secrets within two hours of the initial exploitation. The attackers also established an NTLM relay tunnel into Active Directory and attempted to escalate privileges to Domain Admin.
Unit 42 said the attackers used structured command output that could be processed by an AI model, suggesting an approach designed to make post-exploitation activity more systematic.
Separately, Palo Alto Networks reported that its Cortex Xpanse telemetry identified more than 22.6 million potentially vulnerable internet-exposed instances. This figure indicates the scale of potential exposure identified by its telemetry; it should not be interpreted as the number of confirmed compromised systems.
The findings underline an important distinction. Exploiting a vulnerable server may be only the first stage of an attack. Once inside, attackers can attempt to obtain credentials, move across connected systems and escalate privileges.
Check Point tracks exploitation attempts across regions
Check Point Research has reported widespread attempts to exploit PHP2Shell since details of the vulnerabilities emerged.
In an October 22 update, the company said 10% of organisations in its global telemetry had been impacted, defining impact as exploitation attempts rather than confirmed successful attacks. Europe recorded a 14% rate, compared with 6% in North America, Latin America and Asia-Pacific.
Check Point also reported that India recorded a 14% impact rate in its tracking, placing it among the countries with elevated observed activity. These figures reflect the company’s telemetry and methodology, rather than a census of all organisations in each country.
The company has made Intrusion Prevention System (IPS) protections available and recommends enabling the latest signatures in prevention mode. It also says its Web Application Firewall can help protect against PHP2Shell attempts.
However, Check Point cautions that updating a website’s content management system or plug-ins does not fix a vulnerability in the underlying PHP runtime. Organisations need to identify and update the PHP installations running their applications.
The company’s advice extends beyond patching. It recommends inventorying PHP instances, including those in containers and third-party products, checking hosting-provider remediation, restricting access to systems that cannot be patched immediately and looking for signs of possible compromise.
Cloudflare says protections preceded public disclosure
Cloudflare says it developed and deployed Web Application Firewall protections in advance of the public disclosure of the vulnerabilities.
In a company blog published on October 21, Cloudflare said it had participated in coordinated mitigation efforts with the PHP Foundation and other organisations. Its protective rules were deployed approximately nine hours before public disclosure.
The company said the vulnerabilities could potentially allow denial of service, remote code execution and data exposure when an application processes specially crafted HTTP traffic.
Cloudflare’s response illustrates the role of internet infrastructure providers in reducing exposure while organisations prepare and deploy patches. A WAF can help identify and block malicious requests before they reach vulnerable applications, provided the relevant protections are enabled and effective against the attack.
But the company also makes an important qualification: WAF protection does not replace updating PHP. The flaws reside in the runtime, so application-code changes or plug-in updates alone are insufficient.
For organisations using managed hosting, Cloudflare recommends confirming that the hosting provider has updated the PHP software, rather than assuming that protection at the network edge resolves the underlying vulnerability.
Fortinet strengthens application-layer defences
Fortinet has also published guidance on PHP2Shell through its corporate blog and Fortinet Community.
Its FortiGuard Labs guidance focuses on reducing risk while organisations patch affected systems. Fortinet has also detailed targeted signatures for FortiWeb and FortiAppSec Cloud.
The company’s published guidance identifies signature build 0.00438 or later as containing three targeted signatures intended to block PHP2Shell exploitation attempts.
These protections can provide an additional layer of defence for organisations using the relevant Fortinet products. Administrators must nevertheless verify that their systems are running the required signature versions and that the protections are appropriately configured.
Fortinet’s guidance reinforces a broader point for security teams: knowing that a vendor has released a signature is not the same as confirming that the signature is active across the organisation’s infrastructure.
Sophos investigates potential product impact
Sophos has issued a formal security advisory acknowledging the two vulnerabilities and stating that it is investigating whether any of its products or services are affected. Its October 21 advisory says the company will update the notice with findings and remediation guidance as its investigation progresses.
The advisory is a reminder that software vendors must assess their own products and dependencies, not just advise customers to patch. Security products themselves may incorporate open-source components, and determining whether those components are present and exposed is an important part of vulnerability response.
Why PHP2Shell requires more than a routine patch cycle
PHP is widely used to power websites and web applications. Because PHP2Shell affects the runtime, the risk can extend across different application frameworks, content management systems and hosting environments.
This creates a visibility problem. An organisation may know which websites it operates without having a complete inventory of the PHP versions running behind them. PHP may also be bundled with third-party applications or managed by external hosting providers.
The second challenge is the gap between detecting exploitation and determining whether a system has been compromised. An attempted exploit does not necessarily succeed, and a lack of obvious application-level errors does not establish that a server is safe.
Organisations therefore need to treat patching and incident investigation as separate activities. Applying a fix closes the known vulnerability, but it does not establish whether attackers exploited the system before remediation.
What organisations should do now
The guidance from the security vendors points to five immediate priorities:
1. Inventory PHP deployments. Identify internet-facing servers, containers, third-party applications and externally hosted websites that depend on PHP.
2. Apply the relevant PHP security updates. Prioritise exposed systems and verify that services are running the patched versions. Updating a CMS or plug-in alone is not sufficient.
3. Enable protective controls. Confirm that applicable IPS, WAF and other security signatures are current and operating in the intended prevention mode. Treat these controls as an additional layer, not a substitute for patching.
4. Investigate potential compromise. Review web-server error logs, process execution, unexpected PHP files, suspicious outbound connections and attempts to access credentials or move laterally. Use endpoint and network telemetry where available.
5. Restrict systems that cannot be patched promptly. Reduce unnecessary internet exposure, limit outbound connections and consider temporarily taking a vulnerable service offline if the risk cannot otherwise be controlled.
A test of security operations readiness
PHP2Shell demonstrates how a vulnerability in a widely deployed software component can create a simultaneous remediation challenge for organisations across industries.
The vendor responses also show that effective defence requires several capabilities to work together: asset discovery, rapid threat intelligence, exploit blocking, patch management and investigation of possible compromise.
The most consequential finding from Palo Alto Networks is not simply that exploitation has been observed, but that attackers have used the initial access to pursue credentials and broader network access. Check Point’s telemetry illustrates the breadth of attempted exploitation, while Cloudflare’s early deployment of WAF rules shows how protective measures can be put in place before public disclosure.
For security leaders, the immediate task is to establish where vulnerable PHP is running, verify that it has been updated and determine whether any exposed system was targeted before the fix was applied. Protective signatures can help buy time, but the underlying vulnerability must still be addressed.