Zero-day protection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Another day, another zero-day attack stopped before the vulnerability was even announced. PHP2Shell hit the internet hard with a bug in a single plugin that put the web at risk, but open-appsec and Check Point WAF (open-appsec's enterprise edition) pre-emptively blocked it with no patching or downtime needed.
By now, the stats have been shared, with 10% of organizations worldwide have been impacted (“impacted” means exploitation attempts; we have no way of knowing if the attack has been successful), according to Check Point Research.
PHP2Shell is a pair of critical flaws in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. One crafted request can let an unauthenticated attacker run code on the server, before the application itself ever sees the request.
Let’s understand what PHP2Shell is, who is affected, what to do now, and how open-appsec and Check Point WAF (open-appsec’s enterprise edition) block it pre-emptively, including the public PHP2Shell proof of concept (PoC).
Understanding PHP2Shell
Both bugs live in PHP core, not in any one framework:
CVE-2026-109618: a request that drives PHP out of memory mid-parse can leave internal request structures half-built
CVE-2026-109619: state left over after a fatal error can be reused, leading to a heap use-after-free
Risk is highest on Apache mod_php, and public exploits target PHP’s session upload-progress feature. Details leaked on October 20, 2026, PHP shipped fixes on October 21, and attack traffic showed up before the patch did.
Affected versions
This includes any app on an unpatched PHP is exposed, including WordPress, Drupal, Joomla, Magento, and hosting panels like cPanel and Plesk. Updating the CMS or its plugins alone does not fix it. Which versions are most vulnerable?
PHP branch | Fixed in |
8.5 | 8.5.12 |
8.4 | 8.4.27 |
8.3 | 8.3.36 |
8.2 | 8.2.35 |
8.1 and older | No upstream fix (end of life) |
open-appsec and Check Point WAF: pre-emptive protection
open-appsec and Check Point WAF (open-appsec's enterprise edition) do not wait for a PHP2Shell signature. Their dual AI engine uses context to protect against zero-day attacks before any CVE is announced. How does it work?
First, it decodes the full request, including multipart bodies and encoded content
Then, it weighs where a value lands and who sent it, not just what it contains
Finally, it scores requests for code-execution and injection patterns instead of matching fixed strings
We replayed the public PHP2Shell PoC against a PHP app protected by the latest open-appsec release, in Prevent mode on the default Web Application Best Practice, with no CVE-specific update.
open-appsec blocked the exploit traffic pre-emptively.
The log shows why it was able to preemptively prevent any attacks. The engine flagged PHP code tags and an OS-command pattern inside PHP_SESSION_UPLOAD_PROGRESS in the request body, from a low-reputation source, and classified the request as Remote Code Execution. It did the same for Log4Shell, Spring4Shell, and React2Shell.
What should you do now?
Find every PHP instance. Check web servers, PHP-FPM pools, container images, hosting panels, and vendor appliances that bundle PHP.
Patch and restart. Upgrade to a fixed version, then restart PHP-FPM or the web server so the new interpreter loads.
Plan for end-of-life PHP. On 8.1 or older, upgrade to a supported branch or get a vendor backport.
Keep open-appsec in Prevent mode. Detect-Learn logs attacks but lets them through. Set every PHP-facing asset to Prevent, before and after patching.
Summary
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical, unauthenticated RCE in the PHP interpreter, rated CVSS 9.2
It reaches every app on an unpatched PHP, and branches 8.1 and older get no upstream fix
Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later as soon as you can
open-appsec and Check Point WAF blocked the public PHP2Shell PoC with no CVE-specific update, giving you a safety net while you patch
open-appsec is an open-source project that uses machine learning to provide pre-emptive web app and API threat protection against OWASP Top 10 and zero-day attacks, with no signatures to maintain. Learn more at openappsec.io.
