Critical PHP Remote Code Execution (CVE‑2026‑109618, CVE‑2026‑109619) Enables PHP2Shell Campaign Targeting 216 Hosts
What It Is — Two critical vulnerabilities in the PHP engine allow unauthenticated remote code execution via crafted HTTP requests. The flaws affect all PHP versions that handle web requests and date back to PHP 5.4.
Exploitability — Both CVEs carry a CVSS 9.2 score. Exploits were observed in the wild within minutes of public disclosure, with millions of attempts recorded in the first 48 hours.
Affected Products — PHP runtime (all versions handling web requests, from 5.4 onward).
Why It Matters for Trust & Control Assurance
- Continuous vulnerability scanning and rapid patch deployment are essential control evidence for audit readiness.
- Low‑volume, rotating scanning tactics can bypass simple rate‑based alerts; comprehensive logging provides defensible proof of detection.
- Demonstrating timely remediation satisfies multiple framework control objectives (e.g., change management, vulnerability management) in a single audit view.
Recommended Actions
- Deploy the October 21 PHP emergency patches across every web‑server instantly.
- Verify the PHP version and confirm the vulnerable code paths are removed.
- Implement WAF/IPS signatures that block the specific exploit payloads.
- Enable detailed HTTP request logging and retain logs for at least 90 days for audit purposes.
- Integrate automated vulnerability scanning into your continuous monitoring stack to capture future regressions.