# PHP2Shell: What’s affected and how to patch

> Connect breaking threat intelligence to your SBOM, alert the right owners, and carry the response through remediation and verification.
Author: Cantina
Published: October 21, 2026
Topics: PHP2Shell, Clarion, Threat Intelligence, Vulnerability Management
Canonical URL: https://www.cantina.security/blog/php2shell

On October 21, PHP released emergency fixes for **CVE-2026-109618 and CVE-2026-109619**, two critical vulnerabilities known as PHP2Shell that can allow unauthenticated remote code execution. Both carry a **CVSS v4.0 score of 9.2**, and [PHP's advisory](https://www.php.net/archive/2026.php) urges users to update immediately.

As teams rush to patch, they first have to find where vulnerable PHP is running and get that information to the people who can fix it. [Clarion](/clarion) connects the advisory to your software inventory and response tools, helping your team identify exposed services and carry the work through to a verified fix.

## Why PHP2Shell needs immediate attention

Both flaws involve PHP's memory handling when a request fails: one can leave [partially initialized data](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) behind, while the other lets a later request access [state whose memory has already been freed](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). In Apache mod_php, a demonstrated attack path runs before application code, which means updating WordPress or an application dependency alone cannot resolve the underlying runtime vulnerability.

After details leaked ahead of coordinated disclosure, [Cloudflare reported attack traffic](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) and deployed WAF protections, making this an urgent response even though the number of successful compromises remains unknown.

The potential reach is substantial because PHP powers [69.3% of websites with a known server-side language](https://w3techs.com/technologies/details/pl-php), according to W3Techs. Actual exposure still depends on the deployed version and configuration, so teams need to establish what is running in their own environment.

## Connect the advisory to your environment

Clarion's [Threat Intelligence agent](https://docs.cantina.security/clarion/integrations/threat-intel) can take an incoming PHP2Shell advisory and investigate what it means for your organization, using your connected inventory and security tools to build the response.

**Clarion response flow**

1. **Threat intelligence:** Clarion brings PHP advisories in through RSS and Atom feeds or signed threat-intelligence webhooks, then its Threat Intelligence agent reads the source and linked reporting to identify affected versions, exploit conditions and the evidence to check in your environment.

2. **Your SBOM:** The Brain connects repository SBOMs with cloud resources and services, helping Clarion trace a PHP reference to the systems that depend on it. Agents then check available runtime and configuration evidence, keeping an unknown version open for investigation rather than treating a missing inventory match as proof of safety.

3. **Actionable alert:** Clarion records whether the environment is exposed, unaffected or still uncertain, with the evidence behind that decision. Confirmed exposure is prioritized against your escalation settings and routed to configured Slack or Teams destinations.

4. **Remediate + verify:** With the relevant integrations and response skills, Clarion can prepare a remediation pull request, run checks and route review work to your team, asking for approval wherever your tool policy requires it. The issue stays open while the fix awaits review, with verification evidence and actions recorded alongside the investigation.

When an advisory arrives through a configured feed or signed webhook, the agent can compare affected versions with your **software bill of materials (SBOM)** and deployment inventory. From there, it can trace a matching PHP runtime to the services using it, checking vendor backports, internet exposure, and ownership before deciding what needs attention.

That investigation gives the responsible team an **alert with the next step attached**, including the affected service, evidence, and patch guidance. Where telemetry is available, Clarion can also connect suspicious requests with runtime errors and host activity, while keeping any unanswered questions visible.

The same workflow can then move into [vulnerability remediation](/solutions/vulnerability-management) through tickets, update pull requests, and supported response actions, with production changes governed by your permissions and approval policy. Once the update is deployed, Clarion can check the running version and retain the result with the issue, giving the team evidence that the fix reached the service.

For repository dependency alerts, see [how Clarion brings production context to Dependabot triage](/blog/dependabot-alert-triage-production-context).

## Close the issue with deployment evidence

PHP's fixed releases are **8.2.35, 8.3.36, 8.4.27, and 8.5.12**, although distributions may deliver the fix through a backported package. Check your vendor's security notice, restart affected services after updating, and confirm that the web-serving runtime is patched, keeping WAF protections in place as an additional layer of defense.

By keeping the advisory, affected assets, owners, and remediation work in one investigation, Clarion helps your team follow PHP2Shell from the first warning through to evidence that the exposure has been addressed.

[See Clarion in action](/get-a-demo)