TL;DR: Most appliance vendors have shipped php2shell fixes. The remaining exposures linger in devices that will stay vulnerable until someone replaces them. On October 21, 2026, the PHP project fixed two remote code execution flaws in the PHP core code, tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 (Critical).
Php2shell: A Network Edge Risk Playbook
About this summary. This is a short excerpt from the description that Eclypsium published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://eclypsium.com/blog/php2shell-network-appliances-status/
Source attribution: headline and facts are from Eclypsium (eclypsium.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Siemens RUGGEDCOM APE1808
View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens…
PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
TL;DR: As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see…
Siemens Building Automation and Energy Products
View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core…
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate…
The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure…