Four Places PHP Was Hiding: Patching PHP2Shell (CVE-2026-109618/109619) Across the Fleet

Fri, 23 Oct 2026 09:00:00 -0500

On 2026-10-21 the PHP project shipped an out-of-band release fixing a pair of vulnerabilities that quickly got the nickname “PHP2Shell”: CVE-2026-109618 and CVE-2026-109619, CVSS 9.2, unauthenticated remote code execution. Both are use-after-free bugs (CWE-416). One is an out-of-bounds, out-of-memory corruption during multipart request parsing. The other is stale per-request state that gets reused across php-fpm and mod_php workers. Either one lets an unauthenticated attacker who can reach a PHP endpoint corrupt memory in a way that leads to code execution. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The boring read of that advisory is “run apt upgrade and move on.” The interesting part, and the reason this post exists, is that when we went looking for PHP across the fleet, it was hiding in four very different places. A distro package on a mail server. A compiled-from-source binary inside a container image. The web GUI of a pair of firewalls. And the web GUI of a single edge firewall on an older release train. Each of those needed a genuinely different remediation, and each one had a trap that would have let us declare victory while still running a vulnerable interpreter.

This is the write-up of how we found all of it, how we proved each box was actually fixed rather than trusting a version string, and the HA dance that let us patch a production firewall pair with zero WAN outage.

PHP on Support Tools

Four Places PHP Was Hiding: Patching PHP2Shell (CVE-2026-109618/109619) Across the Fleet