Vendors and regulators respond to PHP2Shell vulnerabilities

Cisco, Red Hat, AWS, Google, Palo Alto and other vendors issued advisories and patches for the two critical PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619), fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA, the UK NCSC and CERT-EU urged organizations to patch internet-facing systems and hunt for backdoors.

• PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21, a day early
• Cisco is reviewing over 30 products, including ISE, Expressway and Webex
• Red Hat rates the bugs 8.1 versus NVD's 9.8
• CISA and NCSC advise patching all PHP systems and hunting for backdoors