php2shell: Why Hiding Behind a WAF Isn't Enough

When the php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were privately uncovered on August 1, 2026, by researchers from Calif, OpenAI, and Wiz, some administrators assumed internal routing would protect them. The reality is far harsher. As Amazon Threat Intelligence noted, in-the-wild exploitation attempts started dating back to October 17, days before the public announcement on October 20. At Bouncingball8, we prioritize robust technical awareness, understanding that relying solely on temporary network filters leaves infrastructure exposed to highly motivated threat actors.

The Anatomy of the php2shell Crisis

A CVSS v4.0 base rating of 9.2 immediately signals a severe gap in basic security boundaries. These memory corruption flaws require no authentication whatsoever, allowing an attacker to execute arbitrary code directly on the target machine. While Cloudflare aggressively deployed Web Application Firewall (WAF) mitigations across all plan tiers hours ahead of coordinated disclosure on October 21, temporary filters are not permanent fixes. The Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities (KEV) Catalog by October 26, confirming that threat actors were actively hunting the estimated 32 million unpatched PHP services still exposed online.

A parallel threat, HTTP2Shell, complicates the mitigation landscape even further. Originating as an out-of-bounds write flaw in the Brotli decompression library, it corrupts memory when processing malicious compressed streams. This initially affected Python and Node.js deployments but quickly spread to Windows environments running .NET 8.0 through 11. The PHP Project released emergency patches (versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12) on October 21 at 14:00 UTC. They explicitly labeled the Windows releases with a "-1" suffix to replace the affected Brotli components, underscoring how deeply intertwined these ecosystem dependencies have become.

Local infrastructure felt the pressure immediately as the scope widened. On October 22, the Philippine news outlet Inquirer Technology published reporting addressing the specific risks for Filipino web developers and local hosting environments. Multiple global platforms—including Wikimedia services, DeviantArt, and public portals in the Netherlands, Finland, and Denmark—had already taken systems offline for emergency maintenance on October 21 to prevent breaches. Ignoring this phpvulnerability is a massive risk; international cyber authorities, including the NSA, UK NCSC, CERT-EU, NCSC-NL, and NCSC-NZ, issued official remediation notices instructing administrators to immediately isolate or update their environments before the automated scanning scripts arrive.