Emergency PHP Updates Fix Critical PHP2Shell Remote Code Execution Flaws

Emergency patches have landed for “PHP2Shell”, a pair of critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619 that leave internet-facing web servers and network security appliances exposed to unauthenticated takeover. Rated at 9.2 under the CVSS v4.0 scoring system, these vulnerabilities allow an attacker to send tailored HTTP requests to a vulnerable PHP process and execute arbitrary code without presenting credentials or logging in.

The PHP development team issued emergency updates across all supported branches. Because the language underpins a substantial portion of global web software—including administrative consoles built into security hardware like Palo Alto PAN-OS—the blast radius extends well beyond standard web applications.

Technical Details & AI-Driven Discovery

The PHP2Shell vulnerability pair stems from critical memory and parsing errors deep within the PHP core runtime. In typical web architectures, upstream servers like Nginx, Apache, or internal web services hand incoming HTTP parameters off to the PHP interpreter via FastCGI or direct module bindings. When processing specially crafted parameter payloads, the unpatched interpreter mismanages input validation, triggering memory corruption primitives that give remote attackers control over execution flow.

Threat actors targeting unauthenticated remote code execution flaws of this class normally automate scans against exposed application endpoints. Once code execution is established within the runtime environment, attackers drop web shells, exfiltrate process memory to harvest database or system credentials, and attempt local privilege escalation to achieve root access on the host.

The discovery process for CVE-2026-109618 and CVE-2026-109619 highlights the growing role of automated AI research in vulnerability discovery. Security firm Calif discovered one of the PHP flaws using OpenAI’s GPT-5.6 Sol model as part of OpenAI’s “Patch the Planet” initiative targeting open-source software security. Cybersecurity firm Wiz independently discovered and reported both vulnerabilities. The dual findings prompted a coordinated two-month response process before public disclosure.

Downstream Exposure and Palo Alto PAN-OS Impact

Beyond standard CMS deployments and bespoke web platforms, embedded PHP runtimes inside enterprise management software represent a severe operational risk. Palo Alto Networks confirmed that all versions of PAN-OS and Panorama management software are affected by PHP2Shell due to embedded web management components.

In enterprise environments, administrative appliances like Palo Alto Panorama and PAN-OS firewall interfaces sit at critical network boundaries. An unauthenticated RCE on a firewall management interface gives malicious actors direct, high-privilege access to network routing tables, security policies, and internal traffic inspection nodes. While PHP project updates are available for standalone servers, Palo Alto Networks has not yet released fixed PAN-OS or Panorama software builds, leaving firewalls and central management consoles vulnerable until vendor updates are distributed.

Remediation & Host Scanning

Administrators managing custom applications, web servers, or linux distributions running standalone PHP runtimes must immediately update to the patched release versions:

• PHP 8.5: Update to version 8.5.12 or higher
• PHP 8.4: Update to version 8.4.27 or higher
• PHP 8.3: Update to version 8.3.36 or higher
• PHP 8.2: Update to version 8.2.35 or higher

To identify exposed endpoints, security team Searchlight Cyber released an open-source scanner named php2shell-scanner, which checks network hosts specifically for exposure to CVE-2026-109618 and CVE-2026-109619.

For Palo Alto Networks PAN-OS and Panorama environments awaiting patched vendor builds, administrators should immediately audit perimeter firewalls to ensure management ports (TCP 80/443) are completely isolated from the public internet and accessible only via restricted, out-of-band management VLANs or trusted administrative jump hosts.