PHP2Shell: Critical PHP vulnerabilities – how lywand helps

New vulnerabilities in PHP can, under certain conditions, allow malicious code to be executed on affected systems. Find out which systems are at risk, which updates can help, and how you can use lywand to check your customers’ IT infrastructure. 

What is behind PHP2Shell? 

On October 21, 2026, two critical vulnerabilities in PHP were disclosed under the name PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are rated with a CVSS v4.0 score of 9.2. 

PHP is a widely used programming language used, among other things, for websites, online shops, and web applications. The current vulnerabilities are located directly in the PHP runtime environment. Under certain conditions, attackers can exploit them via specially crafted web requests – even without logging in first. In the worst case, they can execute malicious code or read sensitive information from memory. 

This means that even an up-to-date web application can be at risk if a vulnerable PHP version is running on the underlying system. 

Who is affected? 

Systems that use PHP to process web requests are particularly in focus. These include: 

  • Publicly accessible web servers, websites, online shops, and customer portals 

  • Internal web servers and business-critical web applications 

  • Servers, appliances, and containers with integrated PHP components 

  • Clients running PHP or services based on it 

What matters is not only whether PHP is installed, but also how it is used on the respective system and whether the affected component is accessible. 

Affected PHP Versions and Updates 

Affected Version Branch 

Fixed as of this version 

8.5.x 

8.5.12 

8.4.x 

8.4.27 

8.3.x 

8.3.36 

8.2.x 

8.2.35 

8.1 and earlier 

Upgrade or appropriate vendor patch required 

Security fixes may be backported in PHP packages from Linux distributions. Therefore, the patch status of the respective vendor is also relevant. 

Detecting PHP2Shell: How lywand can Help 

Lywand can detect both PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) using an external check and a network check. Which check type is suitable depends on which system PHP is installed on and how it can be checked. 

  • External check: Checks publicly accessible systems and services for detectable vulnerabilities. 

  • Network check: Examines accessible systems and services within the customer's network. 

This allows MSPs to check different areas of their customers' environments in a targeted manner and centrally prioritize identified vulnerabilities. Important: Detecting a CVE is not proof that an attack has already taken place; conversely, an unremarkable scan does not rule out a threat in every case. 

What should MSPs do now?

  1. Check systems: Use external checks and network checks to identify potentially affected systems. Please note that you must start both the network check and the external check in the platform.

  2. Prioritize risks: Prioritize publicly accessible web servers and business-critical applications.

  3. Install updates: Update affected PHP versions promptly or install appropriate vendor patches. For systems that cannot be updated in the short term, restrict access as much as possible. 

  4. Verify remediation: After remediation, run another check with lywand and verify the actual patch status. 

Continuous Vulnerability Management Instead of a Snapshot 

PHP2Shell shows how quickly new critical security vulnerabilities can require action. For MSPs, it is therefore important to look beyond individual servers and continuously monitor their customers' security posture. 

With lywand, MSPs get a central overview of detected vulnerabilities, can prioritize measures, and verify their remediation. Different check methods complement one another, providing greater transparency across the various areas of the IT infrastructure. 

Check Customer Infrastructure for PHP2Shell now

Take action now and use lywand's checks to identify potentially affected systems and remediate vulnerabilities.

Do you have any questions or need assistance? Contact our sales team at [email protected] or schedule an appointment.

Further Information 

PHP Security Advisory: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp  

Canadian Centre for Cyber Security – PHP2Shell: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619  

NCSC-NL – PHP2Shell: https://github.com/NCSC-NL/php2shell

Bernhard Schildendorfer

October 22, 2026

Category

Guide

Might be also Interesting

Guide

NIS2 in Practice: What Managed Service Providers Need to Know Now

The NIS2 Directive places new demands on companies throughout Europe and simultaneously raises expectations of their IT service providers. In addition to technical measures, the focus is shifting to transparency and verifiability. This article shows what this means in concrete terms and how the requirements can be implemented in practice.

April 20, 2026

Guide

Lywand vs. RMM – Differences & Why the Combination is Essential

RMM tools are indispensable when it comes to ensuring stable and efficient IT operations. However, when it comes to IT security, they quickly reach their limits. Find out why a vulnerability management system is the ideal addition—and how MSPs can use it to strengthen their services in the long term.

September 10, 2025

Guide

Patch management under control? The reality often shows something different.

How a security audit uncovered unexpected weaknesses in patch management - and was the start of a sustainable security strategy.

April 29, 2025