php2shell: patch PHP now, and remember how many of your boxes quietly run it

Call: Patch now. CVE-2026-109618 and CVE-2026-109619 together give an unauthenticated attacker remote code execution on any PHP install that serves web requests. Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix, and CISA says to take those systems offline until you’ve patched.

Exploitation: CISA’s alert, revised Oct 23, says successful exploitation had not been observed at publication. Unit 42 has seen a proof of concept. One post on X claims it’s already being exploited. I haven’t seen that corroborated.

Where PHP hides:

PAN-OS/Panorama management UI, all releases from 10.2 to 12.2. There’s no fixed build yet. Hotfixes are due Oct 26-30. Until they land, restrict management access to a jump host and remove management profiles from untrusted interfaces. GlobalProtect is not affected. (ctipilot write-up of the PAN advisory)
pfSense. Update from SSH or the console, not the GUI, and force-reinstall WireGuard or it may not come back up. Don’t do it over the WireGuard tunnel you’re connected through. (Netgate)
Synology. Update PHP in Package Center. MailStation needs a manual update. (Synology)
TrueNAS. The platform isn’t affected, but PHP-based catalog apps are, so update those images. (TrueNAS)

Sources: CISA, PHP Foundation, CERT/CC VU#763488.