PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on Azure - finding exposed PHP, patching App Service and VMs, and WAF stopgaps

#What happened

On 21 October 2026 the PHP project shipped emergency releases for two remote code execution flaws, nicknamed PHP2Shell:

Key points from the advisories and coverage:

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security team also published minimal source backports for 7.4, 8.0 and 8.1.
• Affected: any PHP that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is the highest risk.
• Exploitation: a working exploit exists, and an exploitation attempt was seen in a honeypot on 17 October, before public disclosure.

Treat this as an emergency change, not a normal patch cycle.

#1. Find PHP workloads

App Service. List sites and their runtime stack:

az webapp list --query "[].{name:name, rg:resourceGroup, kind:kind}" -o tsv |
while read name rg kind; do
  stack=$(az webapp config show -n "$name" -g "$rg" --query "linuxFxVersion" -o tsv)
  case "$stack" in PHP*|php*) echo "$rg/$name  $stack";; esac
done

VMs and scale sets. Use Run Command (or Azure Arc for hybrid servers) to ask each Linux machine what it runs:

az vm run-command invoke -g rg-web -n vm-web-01 --command-id RunShellScript \
  --scripts "php -v 2>/dev/null | head -1; dpkg -l 2>/dev/null | grep -E '^ii +(php|libapache2-mod-php)' | head; rpm -qa 2>/dev/null | grep -i '^php' | head"

For Windows IIS servers, check php.exe -v in the PHP install folder and the FastCGI handler mappings.

Containers. Search image tags and Dockerfiles for php: base images (php:8.3-apache, php:8.2-fpm and so on) in your repositories and in ACR:

az acr repository list -n myacr -o tsv | grep -i php

Warning

Distribution packages often keep the upstream version number and only bump the package release when they backport a fix. php -v alone doesn't prove you're exposed or fixed on Ubuntu, Debian or RHEL. Check the vendor's security notice and package changelog.

#2. Patch

Restarting matters: CVE-2026-109619 lives in worker state, so long-running workers on the old binary stay exposed until they restart.

#3. Shield while you patch

Use WAF only to buy time. It doesn't make an unpatched PHP safe.

• Azure Front Door WAF: Microsoft has said a managed rule for these CVEs is rolling out (expected to finish by 28 October 2026). Check your policy's managed rule set version and that the rule is in Prevention mode, not Detection.
• Application Gateway WAF and other WAFs: check the vendor's guidance for a signature. Until one exists, add rate-limit rules and block obviously abnormal requests (very large bodies or headers) at the edge.
• Restrict exposure: for admin panels and internal PHP apps, add access restrictions (App Service access restrictions, NSG rules or Private Endpoints) so the internet can't reach them at all.

If a system can't be patched quickly, the UK NCSC advice is to consider taking it offline.

#4. Look for signs of compromise

• App Service: review Diagnose and solve problems for repeated worker crashes, and HTTP logs for unusual 500 bursts from a single source around and after 17 October.
• VMs: new or modified files under the web root, new cron entries, unexpected outbound connections from the web tier (NSG flow logs or Defender for Servers alerts).
• Defender for Cloud: check vulnerability assessment findings for the CVE IDs once signatures are available.

#Checklist

• Inventory of every PHP workload (App Service, VMs, containers, Arc servers)
• Each one on a fixed build or vendor-backported package, and restarted
• WAF rule in Prevention mode on internet-facing PHP apps
• Internal PHP apps not reachable from the internet
• Logs reviewed from 17 October onwards
• End-of-life PHP versions on a replacement plan

#Sources

• Help Net Security: PHP2Shell patched (21 Oct 2026)
• Microsoft Tech Community: PHP2Shell upgrade guidance and Azure WAF mitigations