Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
Summary: Unit 42 reported two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, both rated 9.2 under CVSS 4.0. Cortex Xpanse telemetry identified over 22.6 million exposed instances potentially vulnerable, and the flaws are being actively exploited against internet-exposed PAN-OS management interfaces, with Dream Research reporting a campaign chaining PHP2Shell to a Linux kernel privilege-escalation flaw to gain root, which Unit 42 says it independently verified.
Why it matters: Palo Alto Networks says only about 0.02% of its global installed base had internet-facing management interfaces configured and was impacted, but the 22.6 million exposed instances flagged by Cortex Xpanse show how far the PHP2Shell attack surface reaches beyond any single vendor's estate.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-109618CVE-2026-109619
- Related
- Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026PHP2Shell: What to know about two critical PHP flaws Cyber Risks · Oct 26, 2026