Critical PHP2Shell RCE (CVE‑2026‑109618 / CVE‑2026‑109619) – Unauthenticated Code Execution on Windows & macOS PHP Installations
What It Is — PHP2Shell (CVE‑2026‑109618 and CVE‑2026‑109619) is a pair of unauthenticated remote‑code‑execution flaws in the PHP interpreter. An attacker who can reach an exposed PHP service can execute arbitrary commands with the privileges of the web‑server process. The vulnerabilities affect all PHP versions prior to the patches released in November 2026. Linux distributions ship the fix through their package managers, but Microsoft and Apple do not provide an in‑place updater for PHP on Windows or macOS. Consequently, remediation requires a manual binary replacement or a custom upgrade script. Qualys TruRisk Eliminate’s Custom Assessment and Remediation (CAR) capability delivers an automated script that verifies the official build checksum, stops the web service, replaces the binaries, and logs the outcome – usable with a cloud agent or, agent‑less, via an authenticated scanner.
Affected Products — PHP interpreter on Windows and macOS (any version prior to the November 2026 security release).
Why It Matters for Trust & Control Assurance — The flaw tests the control objective of systematic patch management and verifiable remediation, a single control that satisfies multiple frameworks (e.g., NIST CSF Identify‑Protect, ISO 27001 A.12.6).
Recommended Actions —
- Inventory all Windows and macOS hosts running PHP and record their exact version.
- Deploy an automated, auditable upgrade (e.g., Qualys CAR script) or apply the vendor‑provided patches manually.
- Capture upgrade logs and SHA‑256 verification results as evidence for audit readiness.
- Integrate continuous vulnerability scanning to flag any re‑emergence of the PHP2Shell CVEs.