CVE-2026-109618 and CVE-2026-109619: PHP2Shell RCE

Overview

This article describes the PHP remote code execution (RCE) vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, and Cato’s response.
Both vulnerabilities have a CVSS v4.0 score of 9.2 (Critical). Successful exploitation can allow an unauthenticated attacker to execute code with the privileges of the PHP web worker.

There is no impact to the Cato production environment, and IPS protections were published to protect Cato customers.

Background and Impact

On October 21, 2026, the PHP development team released emergency security updates addressing two vulnerabilities in PHP core:

• CVE-2026-109618: Out-of-memory handling can leave internal request data partially initialized. Processing this invalid data during request cleanup can lead to RCE

• CVE-2026-109619: Internal state can reference memory freed after an earlier request. A subsequent request handled by the same worker can access this stale state, potentially leading to RCE

Specially crafted web requests can trigger vulnerable processing paths. Exploitability depends on the PHP version, configuration, runtime, and application behavior.

Environment

PHP advises treating all PHP installations serving web requests as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The following releases include fixes for both vulnerabilities:

PHP 8.1 and earlier are no longer supported by the PHP project. If you use vendor-maintained packages, check your vendor’s advisory for backported fixes. Otherwise, upgrade to a supported, patched release.

What Is Cato Doing?

There is no impact to the Cato production environment.
Cato continues to monitor for additional exploitation methods and may update the signatures as new information becomes available.
Cato developed IPS signatures based on analysis of the official patches and publicly reported exploit activity. Cato published the signatures to protect its customers.
As of Cato’s October 22 assessment, Cato had observed security scanning activity but had not observed exploitation attempts targeting Cato customers.

What Do I Need to Do?

Update affected PHP installations immediately to a release containing fixes for both vulnerabilities. If PHP is included in a third-party product or managed service, follow that vendor’s remediation guidance.
IPS signatures provide an additional layer of protection and do not replace patching affected systems.
If you cannot patch immediately, follow the temporary mitigation guidance in the PHP security advisory. PHP states that temporary configuration changes reduce exposure to specific attack paths but do not provide complete protection.