Act
active
PHP2Shell RCE: No Workaround Works Before Today's 14:00 UTC Patch
- Engineer — Act: PHP2Shell (CVE-2026-109618/109619) are CVSS 9.2 RCE flaws with no sufficient pre-patch workaround; apply the PHP fix the moment it ships at 14:00 UTC today and do not rely on the configuration setting being circulated as a mitigation.
- SOC/IR — Plan: No IOCs or confirmed exploitation are provided, so no immediate hunt is warranted; prepare PHP-targeted RCE detection rules (webshell drops, anomalous child processes from web server workers) to deploy alongside or shortly after today’s patch release.
- Leader — Plan: Confirm with engineering that PHP instances in your environment are on the patch list for today; absent evidence of active exploitation there is no board or customer communication needed yet, but track this if exploitation emerges post-disclosure.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.