Release date: October 22, 2026
Cyber Security Cloud, Inc.

On the evening of October 21, 2026 (Japan time), the PHP development team released details of two critical vulnerabilities (CVE-2026-109618/CVE-2026-109619, commonly known as "php2shell") that could allow malicious programs to be executed on the server from an external source, and a patched version was released. (https://www.php.net/archive/2026.php#2026-10-21-5)
We recommend that administrators of websites and services using PHPcheck the impact on their operating environments and update to the corrected version as soon as possible.
Even if you have a WAF (Web Application Firewall) installed, youwill still need to update PHP. A WAF is a complementary measure that reduces the risk of attacks, but it does not fix the vulnerability itself.

First, here's what we'd like you to do.

1. Check if PHP is being used and what version it is (if you have a vendor, check with them as well).
2. Updating PHP to the corrected version is the only sure solution.
3. If we cannot update immediately, we will take temporary measures in accordance with official information.
4. Check the WAF security measures and settings, and look for any suspicious behavior.

1.脆弱性の概要と想定される影響

The vulnerabilities in question exist in PHP, which is used to run websites and web services. If exploited, an attacker could potentially execute arbitrary code on the server from an external source without requiring authentication such as login. Both vulnerabilities have been rated as "Critical" (9.2/10.0), the highest severity level in CVSS v4.0.

The PHP development team is urging immediate updates to a wide range of PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. In particular, attacks have been demonstrated to succeed with Apache mod_php before the application code even runs.

2.PHPを利用する皆様にお願いしたいこと

① 利用環境を確認し、修正版へ更新する

Please check if your company's website or services use PHP and whether the fix has been applied to the version you are currently using. If you outsource operation and maintenance, please check with your contractor regarding any impact and their response status.

If you are using PHP provided by a Linux distribution or maintenance vendor, please apply the corrected package according to the information provided by each vendor. If you are using PHP 8.1 or earlier, please check whether the vendor has made any corrections and consider migrating to a supported version.

② If you cannot update immediately, take temporary measures in accordance with official information.

If you are unable to update immediately, please consult with your system administrator or maintenance contractor and consider applying the temporary measures provided by the PHP development team. An example of a temporary measure provided in the official information is as follows:

• Disable the Session Upload Progress feature (session.upload_progress.enabled=0)
• For PHP 8.5, disable fatal_error_backtraces (fatal_error_backtraces=0).
• Request size limit (reduction of post_max_size)

All of these methods have specific application conditions, such as requiring configuration changes and worker restarts. For detailed configuration instructions, please refer to the official PHP security advisory.https://www.php.net/archive/2026.php#2026-10-21-5Please check the following.

However, the attack vectors that can be prevented by changing settings are limited, and this does not provide a complete solution.Even if you have implemented temporary measures, please proceed with updating to the corrected version.

③ Check the status and settings of the WAF (Web Application Firewall).

If you are using a Web Application Firewall (WAF), please check the availability of rules for this vulnerability and whether they are applied to your environment.

Additionally, please check the status of countermeasures for requests that exceed the maximum size limit that the WAF can inspect. When changing blocking settings, you need to confirm the impact on normal communications such as file uploads.

Customers using CSC services should refer to "4. To Customers Using CSC Services".

④ Check for any suspicious behavior.

Check the access logs and PHP error logs to look for requests of an unusual size, requests with extremely long processing times, and any abnormal errors.

If you notice anything suspicious, please consult with your system administrator or the company handling your operations and maintenance, and have them investigate, including whether there has been any tampering with files on the server or any suspicious communications. Please note that there is currently no established method to reliably determine if an attack has occurred, and theabsence of abnormalities in the logs alone does not mean that the system is safe. 

3. Situation observed by our company

Even before the release of the patched version, we observed communications that appeared to be targeting this vulnerability.

Furthermore, within our observation range, we observed a sharp increase in requests exceeding the maximum size limit that the WAF can handle, starting around 8 PM on October 21st. After 9 PM, the number of requests exceeded 200,000 per hour, more than 10 times the level during the daytime on the same day (approximately 10,000 to 20,000 per hour).

It cannot be definitively concluded that all of these requests were intended to exploit this vulnerability.However, the PHP development team has cited request size limitations as a mitigation measure for CVE-2026-109618, and large requests may be related to the exploitation methods of this vulnerability. CSC is continuing to investigate and monitor the situation, including its connection to this vulnerability. 

4. To our customers using our services

"Shadankun," "WafCharm," and "Cyber Security Cloud Managed Rules for AWS WAF" have implemented measures to block characteristic requests used in attacks targeting this vulnerability, and we have confirmed that the relevant requests are being blocked after implementing these measures.

Please check the announcements for each service for details on the current status of each service and actions that customers should take (such as setting rules for size overrun requests in WafCharm).

• Status of "Shadankun":https://www.shadan-kun.com/news/20261022-1
• WafCharm compatibility status:https://www.wafcharm.com/jp/news/20261022-1/
• Support status for 'Cyber Security Cloud Managed Rules for AWS WAF': https://www.wafcharm.com/en/managed-rules/support/

However, the WAF countermeasure is only a temporary mitigation measure until the corrected version is applied. Since detection may be evaded by variations in attack methods,we ask that you check your PHP usage and update to the corrected version if you are using our services.

Reference information

• PHP Official: Security Advisory
  • https://www.php.net/archive/2026.php#2026-10-21-5
• CVE-2026-109618: PHP Official GitHub Advisory
  • https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• CVE-2026-109619: PHP Official GitHub Advisory
  • https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

CSC will continue to respond quickly to new vulnerabilities and protect the security of our customers' web services.

*This announcement is based on information as of October 22, 2026. We will update it as new information becomes available.