PHP2SHELL · CVE-2026-109618 AND CVE-2026-109619 · CVSS 9.2
You patched PHP. But did you patch every copy?
Two critical PHP-core flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) were disclosed on October 21, 2026, with exploit attempts reported before public disclosure. The patch is the easy part. The hard part is finding every copy of PHP you're running — and proving the fixed version is the one actually live.
9.2 score
CVSS v4.0 score on both flaws
2 CVEs
critical PHP-core vulnerabilities
4 fixed
release lines patched: 8.5.12, 8.4.27, 8.3.36, 8.2.35
Get PHP2Shell Expert Advice
THE HARD PART
You can't patch what you can't find
PHP can sit inside vendor software, Windows folders, developer tools and container images — often outside a conventional installed-apps inventory. If you can't see every copy, you can't be sure every copy is fixed.
5-STEP RESPONSE
How to respond
A practical order of operations, whatever tools you use.
Use left and right arrow keys to navigate through the cards.
HOW TANIUM HELPS
Respond to PHP2Shell and Build readiness for what comes next.
Use the response to today’s critical vulnerabilities to build a stronger operating model — connecting current endpoint data, exposure context and governed action across IT and security.
| Response stage | How Tanium helps with PHP2Shell | A stronger response to the next critical vulnerability |
|---|---|---|
Find | Locate PHP installations, running processes and bundled copies using Tanium Guardian, Tanium Comply, Tanium SBOM and Tanium Cloud Workloads, where available. | Start with a current picture of your environment rather than rebuilding an inventory during every incident. Give IT and security a shared foundation for investigation. |
Prioritize | Use the PHP installation and running-process information gathered during discovery to inform your investigation. Where exposure is established, prioritize systems attackers can reach. Installation or version evidence alone does not confirm exploitability or compromise. | Move beyond severity scores alone. Bring exposure and potential business consequences into the same conversation so teams can focus effort where it matters most. |
Remediate & verify | Follow the appropriate OS, PHP or application vendor’s update guidance, restart affected services and verify the running version. Bundled PHP may require an application-vendor update; an OS update may not cover every copy. | Build verification into the response process rather than treating a successful deployment report as proof of remediation. Define ownership, approvals and evidence requirements before the next incident. |
Operating model | Bring questions about PHP exposure, response priorities and remediation status into a shared IT and security workflow. | With Tanium Atlas, natural-language questions connect to current endpoint state and governed action. Permissions, approvals and an audit trail keep operators in control. Capabilities depend on deployment, licensing and availability. |
Capabilities vary by deployment model and licensing. Speak to your Tanium team about what's available in your environment.
Response resources
Technical guidance from Tanium's Guardian Research and HuntIQ teams. Free to use, whatever tools you run.
PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619
Handling PHP2Shell with Tanium Atlas: Tanium Tech Talks #175
Guardian on-premises package for PHP2Shell
HuntIQ Tradecraft: Why PHP2Shell is real and still hard to exploit
HuntIQ Tradecraft: Hunting PHP2Shell post-exploitation
Tanium Cloud: Emerging Issues Content
EXPERT SUPPORT
Need any support with PHP2Shell?
Our team can walk you through how to find, prioritize and verify PHP across your environment. The guidance and resources on this page are free to use either way.