PHP2Shell Exploitation Targets a European Government Entity as PHP Ships an Urgent Security Release

PHP2Shell flaws (CVE-2026-109618/109619) used to target a European government entity; urgent PHP release and exploited GlobalProtect flaw. K-12 steps.

  • The Hacker News reports that attackers exploited the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and targeted a European government entity, with signs of AI-assisted post-exploitation activity.
  • The PHP security team issued an urgent release on 21 October 2026 at 14:00 UTC addressing two vulnerabilities; the summaries do not confirm that this release maps to those two CVEs — verify with the official PHP announcement.
  • Help Net Security also reports a Palo Alto GlobalProtect VPN flaw being exploited in the wild; any district running internet-facing PHP (Moodle, WordPress, Drupal, custom portals) or GlobalProtect should treat this as an emergency patch cycle.

What to do now

  1. Tonight: inventory every PHP runtime you own — web servers, containers, and appliances with embedded PHP — then apply the PHP security team's 21 October 2026 release as an emergency change with a documented rollback plan, and verify the running version after deployment.
  2. Patch and verify every Palo Alto GlobalProtect gateway, enforce MFA, restrict access to required users and geographies, and review authentication logs for anomalous or unexpected sessions.
  3. Hunt for PHP2Shell activity: unusual request patterns and POST parameters, webshells in upload or cache directories, unexpected child processes, and outbound connections to unfamiliar hosts; isolate anything suspicious immediately.
  4. Rotate credentials and API keys on any host that was internet-facing and unpatched, force password resets where hashes may have been exposed, and revoke active sessions and tokens for privileged accounts.
  5. Reduce exposure: disable unnecessary PHP functions, segment internet-facing applications from flat internal networks, restrict outbound traffic, and — per Security Affairs Malware Newsletter Round 120 — inventory Plex, WordPress and Rank Math SEO PRO installs and audit GitHub accounts for unrecognized OAuth apps, PATs, SSH and deploy keys.

Related items