PHP2Shell on Windows and macOS: Fix Without a Patch | Qualys

Summary: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers, and while Linux distributions ship fixed packages, Microsoft and Apple do not ship PHP, so Windows and macOS hosts require an in-place PHP upgrade. Qualys TRU published CAR scripts that upgrade each installation to the latest patch release of its current minor series, verifying the official Windows build by SHA256 with rollback on failure and upgrading macOS through Homebrew, run either via Cloud Agent or an authenticated scanner.
Key Takeaway: Many exposed PHP servers sit on DMZ appliances, legacy hosts, and build-lab Mac minis that cannot run a Cloud Agent, so the fix has traditionally meant logging in by hand one server at a time while unauthenticated RCE sits on the perimeter. The scripts also stop at end-of-life series, leaving those hosts on the mitigation script until they can move to a supported branch.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-109618 CVE-2026-109619
Related: Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026
Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) Cyber Risks · Oct 29, 2026