[IMPORTANT UPDATE] PHP2Shell: Block CVE-2026-109618 and 109619

Hello,

Free virtual patching rules for the CrowdSec WAF are out:

→ CVE-2026-109618 rule→ CVE-2026-109619 rule

On Wednesday, PHP released emergency updates for two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated CVSS 9.2 and can allow unauthenticated remote code execution. Thanks to details leaked before disclosure, we released virtual patching rules before the vulnerability became public. We continued to update rules as details became available.

Who is affected?

PHP powers nearly 70% of websites (69.3% of sites whose server-side language is known, W3Techs, October 2026), and both flaws allow unauthenticated remote code execution: an attacker doesn't need to log in to run their own code on your server. Every PHP installation serving web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team considers the risk highest with mod_php.

How can I protect my servers?

1. Update PHP now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. This is the only complete fix.

2. Use the CrowdSec WAF as a temporary shield while you update, and especially for servers running PHP 8.1 or older, which no longer get official updates. Our two free virtual patching rules block the request patterns used by the published exploits. They're a stopgap, not a replacement for updating: for older versions, also ask your Linux distribution or LTS vendor for backported fixes, or plan the upgrade.

Already running the CrowdSec WAF? Both rules are part of the virtual patching collection, so you get them as soon as your hub updates. Run cscli hub update && cscli hub upgrade to make sure.

Not using the CrowdSec WAF yet? Set it up with our guide. It works with NGINX, OpenResty, Traefik, Envoy, HAProxy, and WordPress. Then install the rules:

Get the CVE-2026-109618 rule >>Get the CVE-2026-109619 rule >>

We'll keep refining the rules as new exploit variants appear, so keep your CrowdSec Hub up to date.

Safer together!

The CrowdSec Team