PHP2Shell (CVE-2026-109618 & CVE-2026-109619)

Two critical vulnerabilities have been disclosed affecting PHP, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

These vulnerabilities may allow unauthenticated attackers to execute malicious code on affected servers or access sensitive information.

Organisations running PHP-based websites or applications, including WordPress, Drupal, Joomla and custom PHP applications, should review their exposure. For more information, please see the NIST Advisory

Current Situation

Exploit code has been shared on the internet and threat actors are actively scanning the internet for vulnerable hosts. Patches for this issue have already been released by most vendors and mitigating actions in-lieu of patching have been published by many blue team resources.

Edgescan

We have confirmed that none of our hosts or infrastructure are exposed to these vulnerabilities.

Customer Assets

Scans to identify potentially vulnerable assets are now in place. We have already started performing unscheduled scans for these vulnerabilities and will continue to do so. We will send additional updates as this situation evolves.

If we detect this vulnerability, we will contact you directly.

You may see ad-hoc scan traffic from us in relation to this issue. Please note that we will only ever send scan traffic from our published list of source IP addresses.

Concerned about an exposure?

If you have identified your own vulnerable assets and are concerned about possible exposure, please contact support at shout@edgescan.com detailing the asset(s). We will be able to run further tests and/or confirm the last time that this asset was scanned.