"PHP2Shell" Vulnerabilities: Nearly 70% of the Web is Affected

Urgent Security Alert: Protect Your Servers from Critical "PHP2Shell" Vulnerabilities!

If your organization uses PHP in any capacity, it is time to drop everything and patch.

Cybersecurity agencies globally (including the UK's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)) are sounding the alarm over two critical vulnerabilities discovered in the core of PHP, one of the world's most popular server-side scripting languages.

These vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, carry a severe CVSS 4.0 score of 9.2 out of 10. Threat intelligence firms are already seeing proof-of-concept exploits and malicious activity in the wild.

Here is everything you need to know about this new "PHP2Shell" threat and, most importantly, the exact steps you need to take right now to protect your infrastructure.

Understanding the Threat: Unauthenticated RCE

The core issue lies in how PHP handles memory, allowing attackers to achieve unauthenticated Remote Code Execution (RCE). In simple terms: an attacker can execute malicious commands on your web server without ever needing a username or password.

• CVE-2026-109618 ("php2shell"): This vulnerability involves out-of-memory (OOM) corruption. If PHP's memory handling interrupts an operation, it can leave data partially initialized. The cleanup process then mistakenly treats this uninitialized, invalid data as valid.

• CVE-2026-109619: This flaw creates a "stale global state." PHP can sometimes retain an internal state even after the memory backing it has been freed. A subsequent request handled by the same worker process might then use that stale data before normal initialization resets it.

Who is at risk?

Any organization using any version of PHP is potentially vulnerable until patched.

The Global Action Plan: What to Do

Drawing from the latest guidance from CISA, the NCSC, and major threat intelligence firms, we have compiled a comprehensive, prioritized checklist for IT and security teams.

1. Discovery & Inventory (Leave No Stone Unturned)

Because PHP runs in the background of so many systems, you might be running it without realizing it.

• Audit everything: Identify all systems running PHP across your infrastructure, prioritizing anything internet-facing. Do not limit this to just outdated versions.

• Look beyond standard web servers: Ask your IT team, hosting providers, and software vendors (get it in writing!) if any of your systems use PHP. It is frequently bundled inside control panels, security appliances, phone systems, and other third-party tools.

2. Immediate Patching (The Only Complete Fix)

Updating is the only guaranteed way to mitigate these flaws.

• Update to safe versions immediately: Install the patched versions released on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

• Check vendor packages: If you get PHP through a Linux distribution or hosting provider, apply their updated packages and explicitly confirm with the vendor that the fixes for these specific CVEs are included.

• Restart services: After applying the patch, be sure to restart PHP-FPM or your web server so the worker processes load the newly secured code.

• Address unsupported versions: PHP 8.1 and older are no longer officially supported. If you are on an older version, you must upgrade to a supported release or contact your vendor immediately for a backported patch.

3. Emergency Mitigations (If You Cannot Patch Now)

If immediate patching is impossible, or you are stuck on an unsupported version, you must drastically reduce your exposure.

• Take systems offline: CISA’s direct guidance is clear—if you cannot update immediately, or if you use unsupported versions like PHP 8.1 or earlier, take those systems offline until they can be fixed.

• Deploy a WAF: If going offline is truly impossible, placing the applications behind a Web Application Firewall (WAF) may provide a temporary layer of protection.

• Apply temporary hardening: Review the official PHP security advisories for temporary settings you can apply to reduce risk in the interim.

4. Threat Hunting (Assume Breach)

Because exploit activity began shortly before the patches were widely available, patching alone might not be enough if an attacker has already slipped through.

• Scan for compromise: If you were delayed in patching, actively look for signs of a breach before upgrading.

• Look for specific indicators: Network defenders should monitor for PHP worker processes launching suspicious shells, downloading unexpected tools, creating new scheduled tasks, adding unknown user accounts, or modifying files in the web root.

5. Utilize Free Security Resources

• Check dependencies: Consult the NCSC-NL's published inventory list of software products with a PHP dependency to check if your third-party tools are vulnerable.

• Sign up for alerts: Organizations in the UK should utilize the free NCSC Early Warning service, while US companies should subscribe to CISA alerts to stay ahead of emerging threats.

Detailed Emergency Checks & Mitigation:

Step 1: Run an Emergency Read-Only Scan on GitHub

If you need to move quickly but require a "read-only" approach to avoid disrupting production environments with active exploit scanners, you can audit your code, dependencies, and environments directly via GitHub using the following methods:

Method A: GitHub Dependency Graph & Dependabot (Native & Safe) GitHub’s native software composition analysis is entirely read-only relative to your running production servers.

1. Go to your GitHub organization or repository.
2. Click on the Insights tab, then select Dependency graph on the left menu.
3. Click on Dependabot to see high/critical alerts instantly flagged for your repositories.
4. Check for any instances of Node.js packages or PHP dependencies triggering alerts. 

(Note: Because PHP2Shell and Node.js core flaws are runtime vulnerabilities, Dependabot will catch them if you pin specific vulnerable runtime versions or Docker base images in your repository).

Method B: Global Code Search (Max-Effort Manual Hunt) To look for exposure in chat projects or custom codebases where you might be routing data to self-hosted engines, go to your GitHub search bar and execute global, organization-level searches:

1. For PHP Environments: Search for active PHP deployments using extension:php or filename:Dockerfile "FROM php".
2. For GitLab self-hosted endpoints: Search for URLs pointing to your internal instances using path:.env "GITLAB_URL" or filename:config "gitlab". Ensure they aren't publicly exposed.
3. For Node.js / Chat Projects: Search for vulnerable versions or Brotli usage in your backend chat structures using filename:package.json "node" or look for code utilizing the Brotli decoder.

Method C: Run a Local Read-Only Scanner via CLI If you want a deeper "max-effort" scan over your cloned repositories without granting write permissions to third-party cloud apps, you can use CLI-based open-source tools locally. For example, you can run a read-only filesystem or Docker image scan using Trivy:

trivy fs ./your-repo-directory

This will cross-reference your project lockfiles against the newly updated vulnerability databases containing today's CVEs.

Step 2: Careful Steps to Mitigate

If your scans or asset inventories reveal that you are running internet-facing or internal instances of these stacks, execute these mitigation procedures immediately:

PHP Runtime:

• Identified Exposure:
  Any web server utilizing PHP versions prior to today's emergency releases.
  
  
• Mitigation Action Steps: 
1. Update Runtime Immediately. 
2. Upgrade your servers or container base images to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Updating repository web-code alone will not fix this. 
3. If using a WAF (like Cloudflare), ensure specific rules for PHP2Shell are toggled on to block payload injection.

GitLab:

• Identified Exposure:
  Self-managed GitLab instances (CE/EE).
  
  
• Mitigation Action Steps: 
1. Emergency Patching. If you host your own GitLab instance, immediately upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. 
2. If you cannot patch immediately, isolate the server from the public internet or put it behind a strict VPN. (Note: GitLab.com SaaS instances are already safely patched).

Node.js:

• Identified Exposure:
  Backends, APIs, or chat apps running Node.js 22, 24, or 26.
  
  
• Mitigation Action Step: 
1. Rebuild and Upgrade. 
2. Update your Node runtimes to v22.23.4, v24.22.1, or v26.12.1. 
3. Rebuild your Docker images to pull these latest secure binaries.

Step 3: Hunt for Post-Exposure Compromise

Because active exploits are already occurring in the wild, clearing a code scan isn't enough if your servers were previously exposed. You must assume breach and hunt for indicators of compromise:

1. Check Server Logs:
   Inspect web server logs for abnormally large application/x-www-form-urlencoded POST bodies or suspicious requests hammering session.upload_progress.
   
   
2. Audit Process Spawns:
   Monitor your infrastructure to see if php-fpm, php-cgi, or node processes are spawning unauthorized reverse shells, curl requests, or unexpected system binary calls.

The Bottom Line:
The "PHP2Shell" vulnerabilities are not something you can schedule for next week's maintenance window. Treat this as an active, critical incident. Locate your PHP instances, patch them immediately, and hunt for signs of compromise.

Sources:

Government Cybersecurity Alerts

• UK National Cyber Security Centre (NCSC): "Critical security issue affecting PHP" (October 21, 2026). The NCSC alerts UK organizations to CVE-2026-109618 and CVE-2026-109619, urging immediate discovery of PHP instances and priority patching for internet-facing systems.
  
  
• Computer Emergency Response Team for the EU (CERT-EU): "Critical Vulnerabilities in PHP" (Advisory 2026-018, October 20, 2026). CERT-EU notes the CVSS 9.2 severity of CVE-2026-109618, explaining it allows remote code execution through memory corruption.
  
  
• U.S. CISA: While not directly linked in the search results above, CISA's official domain is cisa.gov, where their alerts on critical vulnerabilities are posted.
  
  

Threat Intelligence & Vendor Reports

• Palo Alto Networks Unit 42: "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619" (October 21, 2026). Unit 42 reports both flaws as remote code execution (RCE) vulnerabilities rated 9.2 (CVSS 4.0), confirms seeing proof-of-concept exploits, and notes that at least one European government took its website offline as a precaution.
  
  
• Google Cloud Security: "Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619" (October 21, 2026). Google outlines the vulnerable versions (5.4 through 8.5.11) and the patched versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35). They confirm the upstream PHP project is not releasing fixes for PHP 8.1 or earlier.
  
  
• CrowdStrike: "CrowdStrike Protects Customers from Threats Delivered via PHP RCE Zero-Days" (October 21, 2026). This report details the technical shared root cause in the Zend engine (longjmp() without unwinding) that leads to the memory corruption in both CVEs.
  
  
• Help Net Security: "PHP2Shell: Critical PHP vulnerabilities patched, update now!" (October 21, 2026). This article quotes the NCSC and computer forensics experts warning about the "long tail" of unpatched embedded installations.

Created & Maintained by Pacific Northwest Computers

Pacific NW Computers

www.linktr.ee/pnwcomputers

www.pacificnwcomputers.com

📞 Pacific Northwest Computers offers Remote & Onsite Support Across SW Washington including Vancouver WA, Battle Ground WA, Camas WA, Washougal WA, Longview WA, Kelso WA, and Portland OR

How-To Live-Swap a Back-UPS Battery Safely

How to Live-Swap a UPS Battery; Safely

When an uninterruptible power supply (UPS) battery fails, it often triggers a loud, continuous alarm or displays a flashing battery error icon. In an enterprise environment, shutting down the server rack, NAS, or network switch connected to that UPS just to swap a battery means unwanted downtime.

Fortunately, UPS devices such as the APC Back-UPS Pro 1350 (BX1350M) support hot-swapping. This means you can replace the internal battery cartridge without powering down the unit or interrupting the critical equipment plugged into it.

Whether you are an end-user maintaining your workstation or a deployment technician following company infrastructure protocols, use this step-by-step guide to perform a hot-swap safely.

Set Up DMARC for Microsoft 365 Hosted Email

 

How to Set Up DMARC for Microsoft 365:
Stop Email Spoofing for Good!

If you own a custom domain, email security isn't optional anymore. Major email providers like Google, Yahoo, and Microsoft strictly require authentication records to ensure your emails reach the inbox instead of the spam folder.

Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents scammers from impersonating your business while boosting your overall email deliverability.

Here is a step-by-step guide to properly setting up DMARC alongside SPF and DKIM for Microsoft 365 (formerly Office 365).

Set Up DMARC for Google Workspace Email

How to Set Up DMARC for Google Workspace:
Stop Email Spoofing for Good!

If you own a custom domain, email security isn't optional anymore. Major email providers like Google, Yahoo, and Microsoft strictly require authentication records to ensure your emails reach the inbox instead of the spam folder.

Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents scammers from impersonating your business while boosting your overall email deliverability.

Here is a step-by-step guide to properly setting up DMARC alongside SPF and DKIM.

Navigating the Cloud: A Washington Law Firm’s Guide

Navigating the Cloud: A Washington State Law Firm’s Guide to WSBA Advisory Opinion 2215

The legal industry is rapidly transitioning to cloud-hosted services for document storage, practice management, and client communication. The benefits are clear: reduced IT costs, enhanced collaboration, and the ability to work from anywhere. But for Washington lawyers, this digital shift brings up a critical ethical question: Is it safe, and is it compliant?

Apple Business Manager: Employee & Employee Apple ID/iPad Setup

Apple Business Manager:

Add Employees & Apple ID/iPad Setup Guide

If you manage devices for a growing team, you already know that handing a brand-new iPad to an employee isn't as simple as just taking it out of the box. Security, app management, and company data protection are huge priorities. That is exactly where Apple Business Manager (ABM) comes in.

Setting up devices through ABM ensures your company retains control of the hardware and data while giving your employees a seamless onboarding experience. But if you're new to the platform, the workflow can be a little confusing.

To help simplify things, I’ve put together this start-to-finish guide on how to onboard a new employee, set up their iPad, and offboard them when it's time to part ways.

Create a Secure, Password-Protected "File Vault" in Windows 11

 

Create a Secure, Password-Protected "File Vault": Windows 11 Pro & Enterprise

Are you looking for a way to keep your sensitive files hidden from prying eyes? Whether it's financial documents, personal photos, or top-secret projects, sometimes you just need a locked folder.

If you are running Windows 11 Pro or Enterprise, you are in luck! You don't need to download any sketchy third-party software. Instead, you can use built-in Windows tools to create a BitLocker-encrypted Virtual Hard Disk (VHDX).

Think of this as a secure digital "file vault" that lives on your computer. When you need it, you enter a password to open it. When you're done, you lock it up, and your files completely disappear from view.

Here's exactly how to set it all up!

Your Router Might Be Lying to You:
The Quiet Rise of DNS Hijacking

Over the last six months, I've been seeing more and more DNS hijack infections on routers, switches, and servers. It's a genuinely clever tactic, and it's worth understanding why: the attacker only needs to briefly gain access and very lightly maintain it. Once they've rerouted your DNS to a server they control, they can quietly sit in the middle of your traffic and analyze your traffic packets, harvest credentials, the works.

This isn't theoretical, and it isn't rare. 

My own server and three customer servers have been hit by this class of attack in the last 3 months. I'm writing this to bring some attention to what's going on, explain how these attacks actually work, and (most importantly) show you how to defend your equipment and check whether it's already been hit, without needing to be a network engineer.

The Fragile State of Modern Tech:

Where Accountability Goes to Die

So... I need to rant about a few things.

Technology today is the most powerful and accessible it has ever been... and yet somehow, also the most unreliable I can remember. We have more computing power, more tools, and more connectivity than ever, yet reliability and accountability feel like they are going backwards. 

At some point, “good enough” stopped being good enough.

We’ve reached a stage where almost everything is “easy” to use on the surface, but underneath, it’s held together with layers of complexity that break in ways that don't make sense anymore. Updates fix one thing and quietly break three others. Features get pushed out half-baked. 

Stability has become an afterthought.

UniFi Console Migration Guide:

Dream Machine Upgrade or Migration: Including Cloud Account Claiming, Cellular WAN Failover, SSH Credential Capture & Orphaned Device Recovery

This guide covers migrating all adopted UniFi devices (APs, switches, cameras) from a Dream Machine (UDM) to a Dream Machine Pro (UDM-Pro) with minimal disruption. It assumes you are replacing the UDM entirely and the UDM-Pro will take the same network role.

This guide has been updated with real-world field experience from an actual UDM → UDM-Pro migration, including the cloud account claiming procedure, Mesh AP tweaks required post-restore, and cellular WAN failover configuration using a designated LAN port as WAN3.

New Computer Migration & Setup: How-To Guide

Setting Up Your New Computer:
A Complete Migration Guide

Getting a new computer is exciting, but the transition from your old system to the new one requires careful planning to ensure nothing important gets left behind. These principles apply universally, regardless of your hardware path: whether you are performing a standard upgrade (PC to PC, Mac to Mac) or switching operating systems entirely (PC to Mac or Mac to PC). Whether you're upgrading at home or replacing workstations at your business, proper preparation can mean the difference between a smooth, stress-free experience and hours of frustration tracking down missing files and forgotten passwords.

This guide will walk you through everything you need to know before, during, and after a computer migration. There are several things you can do ahead of time to make the process faster and more successful; with less surprises!

For Mac/Apple Computer Time Machine Migrations, Click Here!

The Best Way to Transfer Data to a New Mac (Time Machine Guide)

The Cleanest Way to Migrate to
a New Mac Computer

Getting a new Mac is exciting, but the thought of moving all your files, passwords, and specific settings can be daunting. Over the years, I’ve found that one method stands out as the absolute best way to transfer your digital life: Apple’s Time Machine backup combined with Migration Assistant.

The Invisible Carbon Footprint: Top 10 "Greener" Cloud Storage Providers (with NAS Backup)

The Invisible Carbon Footprint: Cloud Storage

If you are serious about data protection, you likely follow the "3-2-1 Backup Rule": three copies of data, two different media, and one offsite. That "offsite" copy is the lifesaver; whether it’s a mirror of your Synology NAS or a full-system image of your workstation. But while your local hardware sits quietly on a shelf sipping 20 watts of power, the cloud datacenter holding those system archives is a different story.

Data centers currently consume an estimated 1-2% of global electricity, a number expected to rise sharply with the AI boom. As IT enthusiasts, system builders, and data hoarders, we have a responsibility to ask: Where are my system backups actually living, and how are they being kept cool?

Finding a "green" provider isn’t just about believing a leaf icon on a homepage. It’s about finding a balance between technical compatibility (S3, WebDAV, rclone) and verifiable sustainability (PUE metrics, water usage, and renewable sourcing). Here are the top 10 cloud storage options that balance robust system and NAS backup needs with environmental responsibility.

QuickBooks Error 3371 Cause, Fix & Prevention

How to Fix QuickBooks Error 3371:

When Repairs Don’t Work

QuickBooks Error 3371, “Could not initialize license properties” is one of the most frustrating QuickBooks errors because standard fixes often fail. Repair installs, reinstall tools, and even Intuit’s own troubleshooters may do nothing.

This article documents a real-world failure mode we see in IT support and some fixes that actually work.

Switch Windows Server Editions Using DISM; Windows Server Activation

Switch Windows Server Editions via DISM

Sometimes you need to change your Windows Server edition; maybe you installed Datacenter but only have a Standard license, or you're migrating licensing models. Here's how to do it in-place without a full reinstall.

Installing Remote Desktop Services on Windows Server 2025 (Workgroup; No Domain)

Installing Supported Remote Desktop Services, on a Workgroup Server (No Domain)

Microsoft’s official stance is that Remote Desktop Services (RDS) generally requires an Active Directory Domain. However, for small environments, standalone servers, or specific test cases, you can set up a Workgroup RDS Deployment.

This guide covers how to install the RDS roles manually, configure licensing without a domain controller, and strictly manage local user access.

⚠ Important Warning: This guide focuses on a Workgroup setup. If you require strict Per-User CAL enforcement or advanced features like RD Gateway, a Domain environment is the only fully supported path.

ScamorHack.com

In today’s digital world, it’s no longer a matter of if you’ll encounter a scam. 

It’s a matter of when.

Whether it’s a terrifying pop-up telling you your computer is "infected," a suspicious charge on your credit card, or the realization that you’ve been locked out of your Facebook or email account, the feeling is the same: panic.

At PNW Computers, we see these situations every day. We know how overwhelming it is to navigate the "what now?" phase of a security breach. 

That is exactly why we created our new resource site: 

www.scamorhack.com

 

PNW Computers' Recommended Hardware

After years of working with small and medium businesses across the Pacific Northwest, I've learned one fundamental truth: the right hardware makes all the difference. Whether you're building out a new office network, upgrading your storage infrastructure, or simply need a reliable mouse that won't quit on you during a critical deadline, choosing the right equipment saves time, money, and headaches down the road.

This guide represents my go-to recommendations for devices that consistently deliver performance, reliability, and value. These aren't just products I recommend; they're the equipment I trust for my own infrastructure and confidently recommend to clients.

Bitwarden Password Vault Cleanup Guide

Bitwarden CLI Vault Cleanup Guide

A comprehensive guide for cleaning up your Bitwarden vault using the CLI, based on real troubleshooting sessions.

Prerequisites

• Bitwarden CLI installed in C:\Tools\Bitwarden (or your chosen directory)
• Windows PowerShell (works with PowerShell 5.x)
• Navigate to the Bitwarden directory in a Windows Terminal: cd C:\Tools\Bitwarden

Quickbooks Multi-User Hosting Troubleshooting

QuickBooks Multi-User Troubleshooting:
Workstation(s) & Server

Please follow these steps to make sure only your server is hosting QuickBooks, and that the QuickBooks Database Server is working correctly.