Can't upgrade PHP? Block PHP2Shell with a WAF
In October 2026, PHP disclosed two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together named "PHP2Shell". The only complete fix is to upgrade PHP. The versions most exposed are the ones that cannot be upgraded: PHP 7 and older are end-of-life and get no official patch, even though they share the same vulnerable code. This post summarizes the vulnerabilities, shows how far a web application firewall (WAF) can protect an application that has to stay on an unsupported version, and where that protection stops.