Identify potential signs of exposure through your domain using Vulnerability Check.
SIBS CyberWatch is monitoring the evolving PHP2Shell vulnerabilities and provides Vulnerability Check to help organisations identify potential signs of exposure. Check your systems for potential exposure using Vulnerability Check.
Two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on 21 October 2026. Both have a CVSS 4.0 score of 9.2 and could allow unauthenticated remote code execution on vulnerable systems.
Which versions are affected?
The vulnerabilities affect versions prior to the following patched releases:
- PHP 8.5.x: Upgrade to version 8.5.12 or later.
- PHP 8.4.x: Upgrade to version 8.4.27 or later.
- PHP 8.3.x: Upgrade to version 8.3.36 or later.
- PHP 8.2.x: Upgrade to version 8.2.35 or later.
- PHP 8.1 and earlier: These versions are no longer officially supported. Check whether your vendor provides patches or plan a migration to a supported version.
What measures should organisations take?
Organisations should:
- Check their domain for potential exposure using PHP2Shell Vulnerability Check ([access here]).
- Identify applications and systems running PHP, including internet-facing services.
- Verify installed versions and apply the updates or patches provided by the vendor.
- Prioritise systems exposed to the public internet.
- Review logs and monitoring mechanisms to identify suspicious activity.
Vulnerability Check can help identify potential signs of exposure in publicly accessible systems. However, this external assessment does not replace technical verification of installed versions, patch status or potential system compromise.
