Fortinet issues guide for critical PHP2Shell PHP flaws
Fortinet's guide covers CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS 4.0, with patches, mitigations and compromise checks.
Fortinet has published a response guide for the critical remote code execution vulnerabilities in the PHP runtime grouped under the name PHP2Shell, according to dailysecu.com. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and were rated 9.2 out of 10 under CVSS 4.0, placing them in the critical category.
Attackers can exploit the two vulnerabilities to execute code on affected servers remotely without authentication. Because the flaw sits in the PHP runtime itself, updating only CMS software or plugins does not resolve it, the guide states.
The guide sets out four steps: identifying affected environments, testing and deploying updates, applying temporary mitigations, and investigating signs of compromise. Fortinet's FortiGuard Labs unit is distributing virtual patches and IPS signatures to reduce exposure while organizations complete their PHP updates.
The exposure is broad. Censys counts roughly 36.7 million internet-exposed services running potentially affected versions of PHP.
PHP underpins widely used website platforms such as WordPress, Drupal, Joomla and Magento, which is why the runtime-level nature of the bugs extends the remediation work beyond a single application update.
Quick answers
What are the PHP2Shell vulnerabilities?
PHP2Shell is the collective name for two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 under CVSS 4.0.
Do CMS or plugin updates fix PHP2Shell?
No. The flaw is in the PHP runtime itself, so updating only CMS software or plugins does not fix it; PHP itself must be updated.
How many services are exposed?
Censys counts roughly 36.7 million internet-exposed services running potentially affected PHP versions.