PHP2Shell: What You Should Know and How Vertek Is Responding

On October 21, 2026, two critical vulnerabilities were disclosed in PHP, a programming language widely used to power websites and web applications. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell and carry a critical severity rating of 9.2 out of 10. 

Given how widely PHP is used, these vulnerabilities are a concern for organizations running affected web applications and servers. At Vertek, we've been following the developments closely, reviewing guidance from our security vendors, and taking additional steps to help identify and respond to potential threats. 

What Is PHP2Shell? 

PHP2Shell refers to two vulnerabilities involving how PHP handles memory while processing certain web requests. If successfully exploited, an attacker could potentially execute malicious code on an affected server without needing to authenticate. 

This could allow an attacker to gain unauthorized access, steal information, install malware, or use the compromised server to move further into an organization's environment. 

What makes these vulnerabilities particularly concerning is that they exist within the PHP runtime itself, rather than in a specific website or application. This means even a well-secured application could be affected if it's running a vulnerable version of PHP. 

Security updates are available, and organizations should prioritize identifying and updating affected installations. 

How Is Vertek Responding? 

When critical vulnerabilities like PHP2Shell are disclosed, our focus is on understanding the potential exposure, reviewing available protections, and making sure we have the appropriate monitoring in place. 

As part of our response, we have been developing and validating additional detection capabilities within Microsoft Sentinel to help identify suspicious activity associated with PHP exploitation and potential follow-on attacks. 

We're also reviewing emerging threat intelligence, evaluating available vulnerability information, and coordinating our findings across the security technologies we support. 

These efforts complement our existing security monitoring and help our SOC identify, investigate, and respond to suspicious activity as new threats emerge. 

What Are Our Security Vendors Doing? 

We're working alongside our security vendors to understand available protections, identify potential exposure, and incorporate relevant threat intelligence into our response. 

Tenable: Tenable has released vulnerability detection plugins to help identify affected PHP installations and prioritize remediation. Read Tenable's advisory. 

Microsoft: Microsoft has published security guidance and Azure Web Application Firewall mitigations for known PHP2Shell attack patterns. Microsoft Defender and Sentinel also provide capabilities for monitoring suspicious activity. Read Microsoft's guidance. 

Halcyon: Halcyon has confirmed that its protections focus on identifying and blocking malicious behaviors throughout the attack chain, including suspicious processes, malicious tools, and unusual network activity that may follow an initial compromise. 

LevelBlue: LevelBlue has confirmed that its USM Anywhere platform components are not affected by these vulnerabilities. Additional detection and correlation capabilities are still being reviewed. 

AlienVault Open Threat Exchange (OTX): Vertek is subscribed to PHP2Shell-related threat intelligence through OTX, helping our security team track known indicators and emerging activity. Examples include OTX Pulse 1 and OTX Pulse 2. 

What Should Organizations Do? 

Organizations should start by reviewing their vulnerability scan results to identify affected PHP installations, paying particular attention to systems that are accessible from the internet. 

Updated PHP releases include 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations should apply the appropriate updates or vendor-supported security fixes and review older, unsupported versions that may still be present in their environments. 

If these systems can't be patched immediately, organizations should take steps to limit their exposure, such as restricting external access or applying temporary protections until updates can be installed. 

While monitoring and security tools provide important additional protections, they are not a substitute for keeping software updated. 

At Vertek, we'll continue monitoring developments, reviewing guidance from our security partners, and strengthening our detection and response capabilities as more information becomes available. 

Our goal is simple: stay informed, understand the risks, and take the appropriate steps to help protect the organizations we support.