PHP2Shell is the name given to two critical vulnerabilities in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS version 4.0. The flaws are not in WordPress, Drupal, Laravel or any other application. An unauthenticated attacker can run code as the web server account, and one of the pair also exposes worker process memory. Exploitation happens during request startup, before application code runs, so application logs often show nothing.

Patch first. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Restart every worker after the update, because the flaws live in state held by long-running processes. Apache mod_php is the confirmed exploitation path. If you cannot patch yet, disable the upload progress callback for CVE-2026-109619 and remove the out-of-memory trigger for CVE-2026-109618. Neither setting replaces the patch. See the NVD entry for CVE-2026-109618 and the NVD entry for CVE-2026-109619.

Both flaws assume one thing: that an unauthenticated request can reach PHP. Agilicus AnyX removes that assumption. Every request must match a firewall rule before it reaches the connector and the application, and AnyX denies any request that matches no rule. Narrowing those rules is the part most customers can improve today.

Replace broad POST rules with rules that name the path and the people:

• Replace a catch-all rule such as a path regex of /.* with method all by one rule per endpoint, naming the exact path and the method it needs.
• Attach every POST rule to a named role or group. Allow anyone only on a sign-in form, and limit that rule to the exact sign-in path.
• Require a recent multi-factor authentication proof on administrative and upload endpoints, using the maximum seconds condition on the rule.
• Deny the methods an endpoint does not need. A POST rule on a path that only serves pages is unnecessary exposure.
• Keep the common path prefix consistent, and check that the rules follow it after a prefix change.

One limit to be clear about: AnyX rules match method, path, query string and JSON body constraints. The proxy does not parse multipart form or file uploads, so a rule cannot inspect the body of an upload. Do not treat a firewall rule as a substitute for the PHP update.

For more information, see Firewall rules and Web Application Security.