PHP2Shell Emergency: Critical PHP RCE Demands Patch-and-Restart, Plus VPN Hardening

Critical PHP RCE CVE-2026-109618/109619: patch PHP, restart services, scan with php2shell-scanner, and harden VPN edge devices.

  • Emergency PHP updates released 21 October fix CVE-2026-109618 and CVE-2026-109619, pre-authentication RCE bugs; updating WordPress core alone does not fix them.
  • Searchlight Cyber's php2shell-scanner tests host exposure; attacks are ongoing, but no compromises are confirmed as a result yet.
  • School web apps on WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento, plus exposed VPN edge devices, need immediate patching and verification.

What to do now

  1. Inventory PHP, Apache mod_php and PHP-FPM versions across all web servers, starting with internet-facing WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento systems.
  2. Apply the PHP vendor emergency fixes for CVE-2026-109618 and CVE-2026-109619, restart PHP-FPM or Apache, and confirm the patched build is active; do not treat a WordPress core update as sufficient.
  3. Run Searchlight Cyber's php2shell-scanner against external and internal hosts to find remaining exposure, then re-scan after remediation.
  4. Review web server, PHP-FPM and application logs for exploitation attempts, webshells, unexpected child processes and suspicious outbound connections; restrict administrative interfaces and use WAF or virtual patching temporarily.
  5. For edge devices, patch PAN-OS CVE-2026-0257, enforce phishing-resistant MFA on VPN and management access, reset exposed credentials, and rebuild any host showing signs of compromise.

Related items