PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.
Here is what you need to know:
* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2
* The root is a decades-old design choice in PHP's error handling (described more in our post)
* There was evidence of in-the-wild exploitation pre-disclosure.
The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application
We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.
What to do right now:
The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.
Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012.
The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours.
Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.
Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.
Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com
Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618
