AI Software, Inc. Protected Client Websites from Critical PHP Vulnerabilities (php2shell)
Last week, the PHP project issued emergency patches for two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 (collectively nicknamed “php2shell”). Both carry a CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution on internet-facing PHP servers.
These flaws affect memory handling and request lifecycle processing in PHP. They impact nearly all PHP versions that serve web requests (including PHP-FPM, Apache mod_php, and others), with the highest risk confirmed on Apache mod_php. The PHP team stated there are no complete workarounds—updating is the only safe fix. Exploitation attempts were observed in the wild even before the patches were released on October 21, 2026.
At AI Software, Inc., our server firewall was already blocking the known exploit traffic associated with these vulnerabilities. As soon as the official patches were published by the PHP team, our systems automatically applied the updates the same day. As a result, none of the websites we manage were affected by this threat.
This rapid, layered response—combining proactive network-level blocking with same-day automated patching—is part of how we protect client sites. AI Software, Inc. continues to monitor emerging threats and keep the websites we manage secure when issues like this arise.