Critical PHP2Shell vulnerabilities: patch PHP; Azure WAF measures are temporary
🛠️ Microsoft warns about two critical PHP remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can be exploited remotely without user interaction or privileges.
Upgrading to a patched PHP version is the only complete remediation, including inside container images and managed application runtimes.
- Patched branches listed by Microsoft are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Azure Front Door, Application Gateway and Application Gateway for Containers WAF have interim defenses for particular request patterns, but these do not replace patching and can produce false positives.
- An Azure Front Door response-side managed rule is rolling out, with completion expected October 28; the rule is disabled by default and requires customer action when available.
Teams running internet-facing PHP workloads should prioritize updates and validate any WAF mitigations against legitimate application traffic.
Partner briefing
- What it is
Critical PHP2Shell remote-code-execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.
- What’s changing
Microsoft published patch versions and temporary Azure WAF mitigation guidance on October 22. Azure Front Door response-side managed rule rollout is expected by October 28, 2026, and is disabled by default.
- Why it matters
Patching PHP is the only complete remediation; Azure WAF mitigations reduce selected attack paths but are not equivalent to upgrading.
- Who it affects
Azure administrators, managed service providers, security partners and developers operating PHP applications.