Third-Party Vulnerability Disclosure – php2shell (CVE-2026-109618 & CVE-2026-109619)

Informational
21 October 2026, 19:26 UTC

Third-Party Vulnerability Disclosure – php2shell (CVE-2026-109618 & CVE-2026-109619)

Status: in progress
Date: 21 October 2026, 19:26 UTC
Affected Components:
Fastly Customer Services General Updates
Update

21 October 2026, 19:26 UTC

21 October 2026, 19:26 UTC

A security disclosure regarding php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) was published on October 21, 2026. In addition to implementing certain mitigations, we published a blog post about this disclosure for all customers. The post explains how we responded and shares steps you can take to protect your services. Additionally, we have published a second deep dive blog post to help you navigate and implement your own fixes.

What happened?

A set of critical vulnerabilities affecting all maintained PHP versions (php2shell) was disclosed, involving how the PHP engine handles fatal errors like memory exhaustion, timeouts, and dropped connections. To help protect customer environments, Fastly’s Security Research team, in collaboration with OpenAI and community partners, has developed a Virtual Patch for CVE-2026-109618 and CVE-2026-109619. To learn more about this vulnerability and our proactive protections, please read the blog posts linked in the reference section below.

What you can do

We strongly advise taking the following recommended actions:

  • Apply Virtual Patching: Fastly Next-Gen WAF customers are strongly encouraged to apply the Virtual Patch for CVE-2026-109618 and CVE-2026-109619 across all vulnerable Edge and on-prem services. Opting in ensures you automatically receive updates as the rule is refined.

  • Audit Application Servers: Identify all application servers running mod_php or php-fpm and treat all PHP applications as potentially vulnerable.

  • Patch PHP Upstream: Apply official upstream patches. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . For PHP 7.4, 8.0, and 8.1, or older versions, verify available patches with your Linux/package distributor.


Fastly is actively monitoring for exploitation and new variants. Please stay aware of any further updates as this situation develops.   

Customers with any questions, requiring emergency WAF onboarding, or needing support may engage with our Support team through support@fastly.com or by contacting your designated account management team members.


Reference: