Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Following the disclosure of the two critical PHP remote-code-execution flaws dubbed PHP2Shell, CVE-2026-109618 and CVE-2026-109619, major vendors and security firms have spent the days since release scrambling to confirm whether their products rely on vulnerable PHP code. Cisco says it is still reviewing over 30 products and cloud offerings, including Expressway, but has found none affected so far, while Fortinet has cleared FortiOS and roughly two dozen other products and continues investigating the rest. Palo Alto Networks confirmed PAN-OS is impacted at high severity and is preparing fixes alongside interim workarounds, and cloud providers AWS and Google Cloud have already patched or rebuilt affected services such as Elastic Beanstalk and App Engine runtimes. Linux distributions Ubuntu and Debian shipped patches on October 21, and companies including SolarWinds, CrowdStrike and Sophos have published their own exposure assessments, mitigations and detection content, as proof-of-concept exploit code is already circulating publicly.