On October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell, were disclosed in the PHP core runtime. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and could allow unauthenticated attackers to execute arbitrary code, access sensitive data, or disrupt affected services.
CDNetworks has responded promptly by making targeted protection available through its Web Application Firewall (WAF).
What Are CVE-2026-109618 And CVE-2026-109619?
The vulnerabilities involve memory-handling flaws in the PHP runtime. Attackers may exploit these vulnerabilities through specially crafted HTTP requests, such as multipart/form-data file uploads involving PHP’s session.upload_progress functionality. functionality.
Since the vulnerabilities reside in PHP Core rather than a specific application or plugin, websites and services built on PHP, including WordPress, Drupal, and other PHP-based platforms, may be exposed when running affected versions.
CDNetworks WAF Protection Is Available
After the disclosure, the CDNetworks Security Research Team promptly analyzed the vulnerabilities and validated its mitigation measures
CDNetworks has released a dedicated WAF protection rule (Rule ID: 9657) designed to identify and block malicious requests attempting to exploit these vulnerabilities.
The rule is available to customers using CDNetworks’ web application protection services. Customers should verify that Rule ID 9657 is enabled and that their WAF is configured in Block mode to enforce protection.
Customers whose WAF is currently configured in monitoring-only mode are advised to contact CDNetworks technical support for assistance in enabling blocking.
CDNetworks continues to monitor emerging exploitation techniques and threat intelligence, and will update its protection rules as needed to address evolving attack patterns.
Recommended Actions
CDNetworks recommends that organizations take the following steps:
-
Identify affected assets: Review PHP versions across web servers, PHP-FPM, Apache, container images, CLI scripts, and long-running processes, paying particular attention to PHP 8.1 and earlier unsupported versions.
-
Apply security patches: Upgrade to the latest patched PHP releases, including PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as applicable.
-
Verify successful remediation: Restart affected services, rebuild container images where necessary, and verify the PHP version used by running production processes. The version reported by
php -vmay differ from the version serving web requests. -
Strengthen interim protection: For systems that cannot be patched immediately, restrict unnecessary public access and ensure CDNetworks WAF protection is enabled in Block mode. PHP settings such as
disable_functionsandopen_basedirshould not be relied upon as effective mitigations for these vulnerabilities.
WAF protection helps reduce exposure to exploitation attempts, but upgrading to a patched PHP runtime remains essential for complete remediation.
The CDNetworks Security Research Team will continue to monitor these vulnerabilities and refine its security protections to help customers secure their applications.
For further assistance, please contact your CDNetworks account manager or technical support team.