FortiGuard Outbreak Alert: PHP2Shell Remote Code Execution Vulnerabilities
Description | PHP is a widely used scripting language that runs on web servers to generate dynamic websites and applications. PHP has patched CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution, potentially exposing sensitive data or disrupting services. CVE-2026-109618 is a critical memory corruption vulnerability in PHP’s out-of-memory error handling that can allow an unauthenticated attacker to execute arbitrary code through crafted web requests, potentially exposing sensitive data, enabling unauthorized modifications, or disrupting services. CVE-2026-109619 is a critical use-after-free vulnerability in PHP that can allow an unauthenticated attacker to execute arbitrary code by exploiting stale memory references across requests handled by the same PHP worker, potentially exposing sensitive data, enabling unauthorized modifications, or disrupting services. The following table lists the affected PHP versions and the corresponding fixed versions for both vulnerabilities:
For more details, please refer to the security advisory posted by PHP below: Security advisory: Critical remote code execution vulnerabilities, update now | |||||||||||||||
CVE ID | ||||||||||||||||
NDR Cloud Detection Rule | FortiNDR Cloud v26.3+
| |||||||||||||||
Playbook | N/A | |||||||||||||||
Threat Hunting | FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for "PHP2Shell Remote Code Execution Vulnerabilities" related activities. IOC source: PHP2Shell Remote Code Execution Vulnerabilities | Indicators of Compromise All IOCs relating to "PHP2Shell Remote Code Execution Vulnerabilities" have been added to Threat Intelligence Intel. | |||||||||||||||
Suricata/DPI Coverage | Customers can create custom investigation/detention using the DPI and Suricata signatures below: DPI:
Suricata:
| |||||||||||||||
Other Fortinet Products | For more details regarding mitigating the vulnerability by utilizing Fortinet products, refer to PHP2Shell Remote Code Execution Vulnerabilities. |
