PHP2Shell: find and patch every PHP runtime with Fleet

PHP2Shell refers to two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026, that can allow unauthenticated remote code execution in web-serving PHP installations, including PHP-FPM, Apache mod_php, CGI, FrankenPHP, and LiteSpeed. The flaws involve unsafe cleanup after out-of-memory conditions and stale request-memory pointers after fatal errors, and public exploit activity may have begun before the official release. Mitigation is complicated by diverse PHP deployment methods, vendor backported patches that retain older upstream version numbers, and web workers that continue using vulnerable code until they are fully restarted. Fleet proposes inventory reports and policies that assess full vendor package versions, identify stale PHP and Apache processes, inspect containers and nonstandard installations across Linux, macOS, and Windows, and distinguish unsupported branches without vendor fixes. Its remediation scripts can update packages, restart workers, or apply PHP’s partial interim configuration mitigations where updates are unavailable, while detection guidance focuses on suspicious shells, tools, or scripts spawned by PHP workers and distinctive multipart request patterns.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.