--- title: PHP2Shell will persist in enterprise environments for years description: Two critical PHP remote code execution flaws, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), will remain exploitable in enterprise environments for... canonical: https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP2Shell will persist in enterprise environments for years | daily.dev og:description: Two critical PHP remote code execution flaws, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), will remain exploitable in enterprise environments for... og:url: https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw og:image: https://api.daily.dev/og/posts/UgfrRVsbW.png og:image:alt: PHP2Shell will persist in enterprise environments for years og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP2Shell will persist in enterprise environments for years **[CSO Online](https://daily.dev/sources/csoonline)** · 10 min read · 0 upvotes · 0 comments ## Summary Two critical PHP remote code execution flaws, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), will remain exploitable in enterprise environments for years because PHP ships bundled inside third-party appliances, LTS Linux distros, containers and firmware. The PHP project fixed the bugs in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but VulnCheck found 42% of 2.6 million scanned internet-facing PHP hosts run end-of-life versions. Cogent Security found an average of 2,266 affected assets per Fortune 500 company, with 122 exposed to the internet. CISA has confirmed active exploitation and added both CVEs to its Known Exploited Vulnerabilities catalog. WAFs can't catch every exploit variant because they don't fully inspect multipart upload bodies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the CVE numbers for the PHP2Shell vulnerabilities and which PHP versions fix them? PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA added both CVEs to its Known Exploited Vulnerabilities catalog after confirming active exploitation, and attackers have been scanning for and attempting to exploit the flaws since disclosure. _Teams tracking critical PHP patches can follow fast-moving CVE coverage on daily.dev._ ### Why can't I just check my PHP version banner to confirm I'm patched against PHP2Shell? Backported patches on Linux distributions often carry version numbers inconsistent with upstream releases, so a scanner reading the version banner can wrongly flag a patched host as vulnerable. For example, AlmaLinux's patched php-8.3.33-1.el10_2.alma.1 reads lower than the upstream fixed version 8.3.36, even though the fix is applied. _Developers reconciling distro package versions against upstream fixes can track these quirks on daily.dev._ ### Can a web application firewall fully block PHP2Shell exploits? No, a WAF cannot block all PHP2Shell exploits that abuse multipart form-data uploads, because WAFs typically don't inspect the full body of a web request the way the PHP engine does. Attackers can pad payloads with junk data to push malicious code past a WAF's inspection limit, or bypass the WAF entirely by hitting a backend server's direct IP address. _Security teams weighing WAF coverage for PHP exploits can track mitigation gaps on daily.dev._ ## Similar posts on daily.dev - [PHP2Shell: Prepare for the Next Vulnerability](https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1) · Snyk · 0 upvotes · 0 comments - [CISA confirms PHP2Shell under attack as researchers clock successful exploits](https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2) · The Register · 0 upvotes · 0 comments - [PHP2Shell Shows Why Security Cannot Stop at the Last Test](https://daily.dev/posts/php2shell-shows-why-security-cannot-stop-at-the-last-test-kibbq2lgf) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHP2Shell will persist in enterprise environments for years","url":"https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw"},"datePublished":"2026-10-29T08:28:50.725Z","dateModified":"2026-10-29T08:30:09.593Z","description":"Two critical PHP remote code execution flaws, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), will remain exploitable in enterprise environments for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e38ac09ded8b240468388b1ae67cd1bc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e38ac09ded8b240468388b1ae67cd1bc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"PHP2Shell will persist in enterprise environments for years"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php2shell-will-persist-in-enterprise-environments-for-years-ugfrrvsbw#faq","mainEntity":[{"@type":"Question","name":"What are the CVE numbers for the PHP2Shell vulnerabilities and which PHP versions fix them?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA added both CVEs to its Known Exploited Vulnerabilities catalog after confirming active exploitation, and attackers have been scanning for and attempting to exploit the flaws since disclosure. Teams tracking critical PHP patches can follow fast-moving CVE coverage on daily.dev."}},{"@type":"Question","name":"Why can't I just check my PHP version banner to confirm I'm patched against PHP2Shell?","acceptedAnswer":{"@type":"Answer","text":"Backported patches on Linux distributions often carry version numbers inconsistent with upstream releases, so a scanner reading the version banner can wrongly flag a patched host as vulnerable. For example, AlmaLinux's patched php-8.3.33-1.el10_2.alma.1 reads lower than the upstream fixed version 8.3.36, even though the fix is applied. Developers reconciling distro package versions against upstream fixes can track these quirks on daily.dev."}},{"@type":"Question","name":"Can a web application firewall fully block PHP2Shell exploits?","acceptedAnswer":{"@type":"Answer","text":"No, a WAF cannot block all PHP2Shell exploits that abuse multipart form-data uploads, because WAFs typically don't inspect the full body of a web request the way the PHP engine does. Attackers can pad payloads with junk data to push malicious code past a WAF's inspection limit, or bypass the WAF entirely by hitting a backend server's direct IP address. Security teams weighing WAF coverage for PHP exploits can track mitigation gaps on daily.dev."}}]} ```