Security2 hOctober 29, 2026, 15:25

PHP2Shell will linger in enterprise environments for years

The critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) are now in CISA's exploited-vulnerabilities catalog, but PHP embedded in NAS devices, firewalls, VPN gateways and OT gear often cannot be patched. VulnCheck found 42% of 2.6 million internet-facing PHP hosts run end-of-life branches.

CSO Online

Open source

PHP2Shell will linger in enterprise environments for years

CISA confirmed active exploitation of both PHP2Shell flaws
42% of 2.6 million PHP hosts run unsupported branches
Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
No official backports exist for PHP 7.3 and older

#PHP#CISA#VulnCheck

PHP2Shell will linger in OT sites well beyond 2030

Security

Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

Security

Mirai botnet joins PHP2Shell attacks as ASLR bypass exploit emerges

Security

PHP2Shell will linger in enterprise environments for years

PHP2Shell will linger in OT sites well beyond 2030

Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

Mirai botnet joins PHP2Shell attacks as ASLR bypass exploit emerges

PHP2Shell exploit bypasses ASLR to achieve RCE on PHP 8.4.26 servers