Post

Fastly
@fastly.com

php2shell (CVE-2026-109618 & CVE-2026-109619) was disclosed today. Every maintained PHP version is affected, and there's evidence of in-the-wild attacks before disclosure. www.fastly.com/blog/fastlys...

3 reposts5 likes

Fastly
@fastly.com

The root cause: when PHP hits a memory limit, timeout, or dropped connection, it abandons work mid-operation and leaves inconsistent state. Unauthenticated HTTP requests can trigger it. Patches fix the known bugs, but the mechanism remains, so expect variants.

Fastly
@fastly.com

What to do now: find your mod_php/php-fpm servers, patch with urgency (8.5.12, 8.4.27, 8.3.36, 8.2.35; older versions via your distributor), and NGWAF customers should apply the Virtual Patch. Full analysis from Kelly Shortridge: www.fastly.com/blog/fastlys...

fastly.comFastly’s Proactive Protection for PHP2Shell, Critical React RCE CVE-2026-109618 and CVE-2026-109619 | FastlyLearn about Fastly’s proactive protection and virtual patching for the critical php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Read our deep dive.