top of page

CDNetworks Releases WAF Protection for php2shell (CVE-2026-109618 and CVE-2026-109619)

Writer: Phumin Tonglar
Phumin Tonglar
Oct 22
1 min read

Reference: CDNetwork Cloud Security Last updated on October 22, 2026



On October 21, 2026, two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, CVE-2026-109618 and CVE-2026-109619 (collectively dubbed “php2shell”), were disclosed. Both score 9.2 on CVSS v4.0 and could let unauthenticated attackers execute arbitrary code, access sensitive data, or disrupt services.

What’s affected

  • The flaws are memory-handling bugs in PHP itself, so any PHP-based site running an affected version may be exposed, including WordPress and Drupal.

  • Attacks can be triggered via specially crafted HTTP requests, such as multipart/form-data uploads involving PHP’s session.upload_progress feature.

Vendor protection

  • CDNetworks released WAF Rule ID 9657 to detect and block exploit attempts.

  • Customers should confirm the rule is enabled and that the WAF is in Block mode. Those in monitoring-only mode should contact technical support.

Recommended actions

  1. Identify affected assets: check PHP versions across web servers, PHP-FPM, Apache, container images, CLI scripts and long-running processes, especially PHP 8.1 and earlier unsupported versions.

  2. Patch: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as applicable.

  3. Verify: restart services, rebuild container images, and confirm the version used by running production processes, since php -v may differ from what serves web requests.

  4. Interim protection: restrict unnecessary public access and keep the WAF in Block mode. Do not rely on disable_functions or open_basedir as mitigations.

Bottom line: a WAF reduces exposure, but upgrading to a patched PHP runtime is the only complete fix.

bottom of page