PHP Vulnerabilities Expose Millions to Remote Code Execution Risks

“Cortex Xpanse has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619,” Palo Alto Networks’ Unit 42 reported — a single figure that frames the scale of this week’s PHP emergency.

Scope: 22.6 million exposed instances and a global footprint

Palo Alto Networks’ telemetry — reported by Unit 42 — shows more than 22.6 million public-facing instances that Cortex Xpanse has identified as potentially vulnerable to the two PHP remote code execution (RCE) flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Unit 42 emphasizes that “PHP is widely used across web servers and content management systems globally” and recommends organizations assess their exposure and patch immediately.

CVE-2026-109618 and CVE-2026-109619: the technical failure modes

Both vulnerabilities are rated 9.2 (CVSS 4.0) and permit remote code execution, but they arise from related but distinct flaws in PHP’s fatal error and out-of-memory handling:

• CVE-2026-109618 — a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
• CVE-2026-109619 — a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.

Unit 42 points organizations to the PHP Group’s security advisory and patching guidance and urges immediate remediation.

Unit 42 investigation and the October 25 retraction

Unit 42 disclosed that earlier reporting had linked observed post-compromise activity to the PHP2Shell vulnerabilities. According to Unit 42: “What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application. This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.”

The October 25 update explicitly retracts the October 23 update and clarifies that the initial access vector in that incident cannot be confirmed as tied to CVE-2026-109618 or CVE-2026-109619.

Protections available from Palo Alto Networks and detection timelines

Palo Alto Networks lists a multi-product defense posture available to customers and provides specific deployment and signature details:

• Cortex XDR and XSIAM: multilayered protection against post-exploitation activities and visibility into installed software on endpoints and servers to help prioritize remediation.
• Cortex Cloud and Prisma Cloud: identify vulnerable PHP versions across code, registry images and runtime instances; Cortex Cloud’s Supply Chain Attacks Portal and Cortex CLI can help prevent vulnerable components from being reintroduced into CI/CD pipelines.
• Cortex Xpanse: identifies exposed devices on the public internet and can escalate findings to defenders; customers are advised to enable the PHP Attack Surface Rule for alerting.
• Next-Generation Firewall: Advanced Threat Prevention Plus with Frontier Virtual Patching has provided protection since 10:21 p.m. PT on October 20, 2026 via Threat ID 543004. Advanced Threat Prevention with best practices has provided signatures since October 21, 2026 via Threat Prevention signatures 543004, 97622, 97623, 97624, and 97625.

Unit 42 also offers tailored adversary intelligence, direct analyst consultations, exposure tracking, and incident response engagements.

What this means for technologists, enterprises, and incident responders

• Technologists and security teams: Use Cortex XDR/XSIAM visibility to identify systems running vulnerable PHP versions and prioritize remediation; leverage Cortex Cloud and Prisma Cloud to scan code, images, and runtime instances and block vulnerable images via Cortex CLI in CI/CD.
• Enterprises and procurement leaders: Review firewall subscription coverage and ensure Next-Generation Firewall subscriptions include Advanced Threat Prevention or Advanced Threat Prevention Plus, noting the threat ID and signature coverage deployed on October 20–21, 2026.
• Incident responders and affected organizations: If compromise is suspected, Unit 42 recommends engagement with its Incident Response team; contact numbers are provided for regional support, including a North America toll-free number +1 (866) 486-4842 (866.4.UNIT42) and regional numbers for the UK, Europe and Middle East, Asia, Japan, Australia, India, and South Korea.

Unit 42’s central, actionable guidance is unambiguous: assess exposure and patch immediately. The updated record — including the October 25 retraction of an earlier link between a specific post-compromise incident and these CVEs — underscores two parallel truths in this episode: the vulnerabilities are severe and widespread, and attribution of any observed intrusion to these CVEs requires careful forensic confirmation.

For organizations that manage web-facing PHP assets, the immediate steps are concrete and already documented by the vendors cited here: consult the PHP Group’s security advisory, apply patches, and use the described detection and mitigation controls in Palo Alto Networks’ portfolio.

Original Unit 42 advisory: CVE-2026-109618, CVE-2026-109619