LIONIC Responds to Critical PHP2Shell Vulnerabilities Providing Virtual Patching Protection Services

Hsinchu, Taiwan – Oct 22, 2026

Two critical remote code execution (RCE) vulnerabilities, each rated CVSS 9.2, have raised security concerns LIONIC is actively developing IPS protection rules to help customers mitigate potential attack risks

PHP recently disclosed two critical security vulnerabilities, collectively referred to as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received a CVSS v4.0 score of 9.2, placing them in the Critical severity category. Under certain conditions, attackers may exploit these vulnerabilities to execute arbitrary code on affected servers without authentication, potentially threatening website services, system security, and sensitive data. On October 21, 2026, the PHP development team released security updates and urged system administrators to promptly identify affected environments and apply the necessary patches.

In response to this critical security incident, LIONIC, a specialist in Deep Packet Inspection (DPI) and network security technologies, is leveraging Intrusion Prevention System (IPS) protection rules to provide customers with virtual patching capabilities. For systems that cannot be upgraded immediately, these rules help mitigate the risk of exploitation and provide additional time for customers to implement official security patches.

PHP2Shell Vulnerability Risks: Potential Remote Code Execution

PHP is one of the world’s most widely used server-side programming languages, powering a broad range of websites, online services, and content management systems, including WordPress, Drupal, and Joomla. Since PHP2Shell involves security weaknesses in the PHP execution engine itself, updating application code or plugins alone is insufficient to eliminate the risk. Organizations must also verify whether their PHP runtime environments are affected.

The two vulnerabilities stem from the following issues:

CVE-2026-109618: Remote Code Execution Due to Improper Handling of Memory Exhaustion

When PHP encounters an out-of-memory (OOM) condition, an interruption in the request-processing workflow may leave internal data structures incompletely initialized. Subsequent cleanup operations may then use invalid data, potentially creating a remote code execution vulnerability.

CVE-2026-109619: Remote Code Execution Due to Stale Global State

PHP worker processes may retain references to request-related data even after the associated memory has been released. Subsequent requests may then access invalidated data, resulting in a use-after-free vulnerability that could potentially lead to remote code execution.

According to the PHP project’s official advisory, PHP deployments that process web requests may be affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The actual level of risk depends on the deployment architecture, system configuration, and application execution paths.

LIONIC Recommends a Two-Pronged Response: Patch Vulnerabilities at the Source and Strengthen Network-Level Protection

Given the potential operational and cybersecurity impact of these critical vulnerabilities, LIONIC recommends a two-pronged approach that combines system patching with network-level protection to proactively reduce potential risks.

1. Identify Affected Systems and Prioritize Security Patching

Organizations should verify whether their internal systems and related services use affected PHP versions, assess the scope of exposure based on official advisories, and apply the necessary security updates and patches.

Organizations should also inventory all externally accessible PHP environments and ensure that every server, container, and worker process has been updated. This helps prevent security gaps caused by overlooked instances.

2. Leverage IPS Protection Rules to Help Mitigate Attack Risks

For systems that cannot be upgraded or patched immediately, LIONIC also provides IPS protection rules to help mitigate risks through network traffic inspection and attack signature detection.

This approach provides an additional layer of defense while system patches are being deployed, reducing the likelihood that certain malicious traffic will reach protected environments. Actual protection effectiveness depends on rule coverage, product version, deployment architecture, and traffic inspection conditions. IPS protection does not replace official PHP security updates.

Recommended Immediate Protective Measures for Enterprises

LIONIC recommends that enterprises and system administrators take the following measures to reduce the potential security risks posed by PHP2Shell:

1. Identify Affected Versions and Apply Updates Immediately The corresponding patched versions for PHP 8.2, 8.3, 8.4, and 8.5 are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, respectively. Administrators running older versions should upgrade as soon as possible or consult their vendors to confirm whether applicable backported security patches are available.

2. Apply Virtual Patching Through IPS Protection Rules Customers using LIONIC Intrusion Prevention System (IPS) solutions can update to the latest protection rules to help block attacks targeting these vulnerabilities before system updates are completed.

   (1) SID: 8106730 PHP Stale Global State RCE CVE-2026-109619
   (2) SID: 8106731 PHP OOM Corruption CVE-2026-109618
   (3) SID: 8106732 PHP OOM Corruption CVE-2026-109618

Strengthening Defense-in-Depth with Proprietary DPI Technology

LIONIC has long been committed to the independent development of its proprietary Deep Packet Inspection (DPI) engine, cybersecurity threat detection, and network traffic management technologies. Its security solutions cover antivirus protection, intrusion prevention, web threat protection, and content management, serving telecommunications operators, network equipment manufacturers, semiconductor companies, and other enterprise customers.

As cyber threats continue to evolve, LIONIC will continue monitoring the PHP2Shell vulnerabilities and related attack techniques, advancing applicable IPS protection rules and providing customers with relevant protective measures.

LIONIC emphasizes that effective responses to critical vulnerabilities require a combination of security patching, system inventory management, network traffic monitoring, and defense-in-depth strategies. Through proactive response measures and continuous updates, organizations can more effectively reduce the risk of vulnerability exploitation while strengthening the security and operational resilience of their network services.