PHP2Shell: Azion releases a hotfix on Marketplace for CVE-2026-109618 and CVE-2026-109619

PHP disclosed two critical runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, both rated CVSS 9.2 and capable of enabling unauthenticated remote code execution through specially crafted HTTP requests. The flaws involve out-of-memory corruption and stale internal request state, affect common PHP web-serving environments, and require upgrades to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for a complete fix, since application, framework, or plugin updates alone are insufficient. Azion offers a PHP2Shell Firewall hotfix through its Marketplace that blocks known attack paths before requests reach PHP, including abuse of the PHP_SESSION_UPLOAD_PROGRESS field, oversized or chunked request bodies, excessive fields, headers, multipart parts, and deeply nested parameters, while failing closed on malformed or unreadable requests. The hotfix can be deployed without server access or worker restarts and supports observation mode for tuning limits before enforcing blocks, but it is intended as a defense-in-depth measure alongside PHP upgrades, restrictive PHP configuration, and host-level monitoring for suspicious process activity.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.