PHP2Shell will persist in enterprise environments for years

Publisher excerpt From CSO Online

Two critical vulnerabilities were announced last week in PHP, the internet’s most widely used web application runtime, and they came with the familiar warning to patch immediately. But CISOs will have to deal with the long tail of these flaws for years due to widespread PHP integration into third-party products with patching cycles customers don’t control. NAS devices, firewalls, VPN gateways, printers, building management panels, industrial IoT devices, and human-machine interfaces (HMIs) inside operational technology (OT) networks have web panels powered by PHP runtimes that cannot be patched directly. And many of these runtimes have unsupported versions for which upstream patches are not available. Vulnerabilities in widely used technologies can linger for years, and some deployments never get patched because they sit inside products that are out of support but still in service. One year after Log4Shell was disclosed in December 2021, nearly three quarters of organizations still had assets vulnerable to the critical flaw in the ubiquitous Log4j Java library, which remained a top attack vector in real-world attacks throughout 2023. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) could be even worse than Log4Shell for enterprises that cannot identify and patch all their assets — and attacks are already under way. On Monday, CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Researchers had previously reported w…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.