Patching PHP2Shell: How to Find and Fix Your Exposure

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) gives attackers unauthenticated remote code execution in the PHP core. Details leaked before the scheduled patch, so defenders have no head start.

PHP sits behind around 70% of websites, including corporate sites, customer portals, marketing pages, and even internal tools exposed by mistake. Any of them can be an entry point. This post explains how Outpost24 customers can use EASM and Outscan together to answer two questions fast: where is our PHP? and which of it is vulnerable?

What PHP2Shell Affects

PHP2Shell stems from flaws in how PHP manages memory when processing web requests:

• CVE-2026-109618 is an out-of-memory handling flaw which can cause request processing to stop while internal request data is only partly set up. The invalid data may then be treated as valid during cleanup.
• CVE-2026-109619 involves PHP retaining references to memory that has already been released. A subsequent request handled by the same PHP worker can then access this invalid memory, creating an opportunity for attackers to manipulate the process.

Both vulnerabilities carry a critical CVSS v4.0 score of 9.2 and could allow unauthenticated attackers to execute malicious code on affected servers. The PHP advisory provides more details; a patch for PHP2Shell was also released on October 21, 2026.

Identifying Your Exposure

The hardest part of a vulnerability like this is usually finding every place where it applies. Most organizations have assets that never made it into an inventory:

• Old campaign or event sites that were never taken down.
• Subsidiaries and acquired companies with their own hosting.
• Staging and test environments left reachable from the internet.
• Sites run by agencies or third parties under your brand.

A scanner only checks the targets you give it. If an exposed PHP server is missing from that list, it stays unpatched and unseen. That's where attackers look first.

How Outpost24 Customers Can Patch PHP2Shell

Step 1: Find Every Exposed PHP Asset with EASM

Outpost24 EASM looks at your organization from the outside, the way an attacker does. Starting from your company name and known domains, it continuously discovers the internet-facing assets linked to you, including the ones nobody listed.

For PHP2Shell, that means:

• Discovery: domains, subdomains and hosts tied to your organization, including forgotten or shadow IT assets.
• Technology fingerprinting: which of those assets run PHP.
• Alerting: PHP is flagged directly in the platform, so affected customers see it straight away.

The result is a current, outside-in list of where PHP is exposed, which is the starting point for remediation.

Outpost24 EASM has insights into vulnerability trends.

You can view specific vulnerabilities and severity scoring.

You can then see which assets are affected, in this case the assets using PHP.

Step 2: Confirm and Prioritize with OutscanNX

Once you know where PHP runs, the next question is which instances are vulnerable. Outpost24's risk-based vulnerability management tool OutscanNX answers it by:

• Scanning your external perimeter from the cloud.
• Scanning your internal networks with local scanners from inside your environment, covering PHP servers that aren't internet-facing.

Both detect vulnerable PHP versions and rank findings by risk. Your team can patch the most exposed systems first, then work through the rest and verify each fix with a rescan.

Better Together: One Signature Set, Full Coverage

The PHP2Shell detection signatures are synchronized between OutscanNX and EASM, so both platforms identify the same issue the same way. EASM tells you where to look, and OutscanNX tells you what to fix.

Assets EASM discovers can feed straight into your scanning scope, which closes the gap between what you own and what you test.

What to Do Now

1. Check EASM for the PHP2Shell alert and review the list of exposed PHP assets.
2. Add any new assets EASM found to your OutscanNX scope.
3. Run OutscanNX to confirm which systems are vulnerable.
4. Patch by priority, starting with internet-facing systems, then rescan to verify.

Not using EASM yet? Contact your Outpost24 account team for a quick demo. We'll show you what your external attack surface looks like and where PHP is exposed.