PHP remote code execution: are your version checks and detections ready?

TL;DR: Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can lead to remote code execution, according to Corelight, and the advisory assigns both a CVSS 4.0 score of 9.2 while the release pairs open source Zeek and Suricata detections with version inventory guidance. HTTP visibility and live software inventory become the practical control plane when widely deployed internet software can be exploited before normal patch cycles catch up.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Building “php2shell” detections before coordinated disclosure”.

By the numbers:

• The advisory assigns CVE-2026-109618 and CVE-2026-109619 a CVSS 4.0 score of 9.2.

Key questions

Q: How should teams respond when a widely used web runtime shows signs of remote code execution risk?

A: Treat the runtime as an exposure surface, not just a software dependency.

Q: Why does passive version inventory matter for vulnerability response?

A: Passive inventory matters because formal asset records often miss unmanaged, shadow, or forgotten systems.

Q: What are the signs that exploit detections for web runtimes are working?

A: You should see correlated alerts that pair suspicious request behaviour with server version context, plus enough evidence to validate whether the event is a real exploit attempt.

Practitioner guidance

• Build passive version inventory from live HTTP traffic Use response headers and page content to identify servers advertising affected PHP versions, including hosts that are missing from authoritative asset records.
• Prioritise alerting on behavioural exploit indicators Tune detections for suspicious HTTP session patterns, unusual multipart headers, oversized serialized fields, and other correlated behaviours that indicate active probing.
• Use dual-stack network detections for triage Combine Zeek notices with Suricata rules so analysts can cross-check a suspicious request against version exposure and reduce false confidence from any single indicator.

Bottom line: Two PHP vulnerabilities can lead to remote code execution, which makes exposure discovery and patch prioritisation the immediate operational problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →