Details of two remote code execution (RCE) flaws in PHP core, now called php2shell (CVE-2026-109618 and CVE-2026-109619), leaked on October 20, two days ahead of the planned disclosure. PHP moved the fix up to October 21 and released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security team rates both 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 and scheduled fixed releases for October 21 at 14:00 UTC.
Most security teams are doing the right first thing: finding PHP in the code they build and the servers they run. That covers half the exposure. The other half is in the software and code you currently acquire from third-party suppliers, where it may be more difficult to identify and triage.
Manifest Cyber already sees PHP in the affected range inside products from Cisco and Palo Alto Networks.
Why Vendor Exposure Is Always the Slow Part and How Manifest Addresses This Exposure
You can scan your own servers in an hour. You cannot scan a sealed firewall, a VPN gateway, or a vendor's container image. For those, you wait for the vendor to inventory its own builds, test, write an advisory, and publish it.
That takes days at best, and often weeks. Meanwhile, security teams email account reps and maintain spreadsheets of "no response yet." Attackers don't wait for the spreadsheet to fill in.
Why do we have to wait days for our third-party software vendors to tell us when they're vulnerable to a new (OSS) vuln, all while adversaries are trying to exploit it?
The answer is that you don't, if you already know what is inside the products you buy. A software bill of materials (SBOM) for each commercial product turns a new open source CVE into a lookup instead of a waiting game.
What Manifest Sees So Far
The Manifest Platform tracks the components inside commercial software through Manifest Supplier Risk. Within hours of the leak, Supplier Risk flagged PHP in the affected range in these products.
Cisco:
Expressway Series and TelePresence VCS, Expressway Core, Policy Suite (CPS), AppDynamics PHP Agent, CNAAP OVA, Docker, and Apache PHP images, IoT and Unified Industrial Wireless, URWB, and unified client images, IEC6400 Edge Compute Appliance, Umbrella SSE and Umbrella GovCloud, Provider Connectivity Assurance, WAE, CXTM, and Duo Access Gateway (end-of-life)
Palo Alto Networks:
PAN-OS, Panorama, WildFire, and CN-Series
A vulnerable PHP version inside a product is not proof the product is exploitable. The product still has to expose the vulnerable code path. But it tells you which vendors to call first, which product versions to ask about, and which appliances to put behind extra controls while you wait.
PHP also powers widely deployed platforms like WordPress, Drupal, and Adobe Commerce. If you run those directly, they belong on your patch list today, not your vendor list.
What We Know About php2shell
The facts are thin but enough to act on.
- Both flaws sit in PHP core. Public reporting describes them as unauthenticated RCE. watchTowr says it reproduced CVE-2026-109618.
- Severity is 9.2 on CVSS v4.0. Early posts claimed 10.0. The PHP security team's rating is 9.2.
- Affected versions include every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Every installation serving web requests is at risk. CERT-EU says every version from PHP 5 onward may be affected. The PHP advisory points to the session upload progress handler, present since PHP 5.4.0.
- Only supported branches get fixes. Reports expect PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. This is particularly difficult when you buy from third-party suppliers. Vendors often build their appliances and agents on older versions of PHP. If a product runs PHP 7.4, there is no release to install, only a source patch.
- Configuration changes will not save you. PHP core developer Gina Peter Banyard said patching is the only mitigation.
- Attackers are moving. Cloudflare reported early attack attempts on October 21 and deployed web application firewall (WAF) rules. Huntress had seen no in-the-wild exploitation in its partner environments as of October 20.
Know Your Blast Radius Before the Advisory
php2shell will not be the last open source vulnerability that lands inside the products you buy. The teams that respond fastest are the ones that already know what those products contain. They spend the first day containing risk, not chasing account reps.
Want your php2shell blast radius across your vendors today? Email info@manifestcyber.com.
