PHP2Shell affected products heat map CVE-2026-109618 · CVE-2026-109619

PHP2Shell is the name for two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619. The PHP project fixed both on 21 October 2026. Every web-serving setup is in scope, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes, as does 8.6.0 RC4. The PHP project also published source backports for 7.4, 8.0 and 8.1 (PHP release announcements). After updating, restart PHP-FPM or Apache so the patched code is loaded.

Any product that ships its own PHP runtime behind a web interface can be affected. That includes firewall and VPN management consoles, NAS devices, network appliances, security tools and OT/ICS systems. These stay exposed until the vendor ships a rebuilt package. The NCSC-NL php2shell list tracks more than 750 products, and this heat map shows their status day by day.

Yes. Amazon threat intelligence saw the first exploitation attempt in its MadPot honeypots on 17 October, before public disclosure. Attempts became widespread once proof-of-concept code circulated on 21 October. Check web logs from 17 October onward for unusual multipart POST requests, PHP worker crashes and new webshells.

Red is vulnerable, grey is under investigation, green is fixed and pale blue is not vulnerable, all as recorded by NCSC-NL for that day. Orange hatching means the product is still vulnerable but the vendor has announced a fix date. Green hatching means the vendor reports a fix that NCSC-NL has not recorded yet, or that the announced fix date has passed. A vendor row shows the worst status among its products. Click it to see each product.

Every time the page loads, it fetches the current software list and change history from the NCSC-NL php2shell repository on GitHub. An open page refreshes every 30 minutes. Phoenix Security adds vendor fix dates, fixes vendors have announced, and products not yet on the NCSC-NL list. That layer is reviewed by hand, and the review date is shown in the footer.

NCSC-NL is a community-maintained list, so it can lag behind vendor advisories. In those cases the heat map shows green hatching and links to the vendor advisory. Always confirm the fixed version in the vendor's own advisory before closing a finding.

Applications such as Drupal, Nextcloud and GLPI are affected only through the PHP runtime they run on. You fix them by updating PHP on the host or container, not by upgrading the application. They are hidden by default so the map focuses on vendor products where you depend on a vendor update. Use the Generic PHP apps toggle to show them.

Restrict its web management interface to trusted networks, apply the vendor's interim mitigation, and watch for the vendor's update. CERT-EU also recommends setting session.upload_progress.enabled=0 to block a related follow-on vector, CVE-2026-115560. The Phoenix Security analysis covers exposure, detection and remediation in more detail.

Yes. The CSV button downloads the rows that match your current filters, including NCSC-NL status, Phoenix notes and source links. The Embed button generates an iframe snippet that keeps your current filters.