# How do I reduce exposure to the PHP2Shell remote code execution family?

- Link: https://www.agilicus.com/faq/how-do-i-reduce-exposure-to-the-php2shell-remote-code-execution-family/
- Published: 2026-10-22T15:36:16+00:00
- Author: Don Bowman

PHP2Shell is the name given to two critical vulnerabilities in the PHP engine itself,
CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS version 4.0. The 
flaws are not in WordPress, Drupal, Laravel or any other application. An unauthenticated
attacker can run code as the web server account, and one of the pair also exposes
worker process memory. Exploitation happens during request startup, before application
code runs, so application logs often show nothing.

**Patch first.** The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Restart
every worker after the update, because the flaws live in state held by long-running
processes. Apache mod_php is the confirmed exploitation path. If you cannot patch
yet, disable the upload progress callback for CVE-2026-109619 and remove the out-
of-memory trigger for CVE-2026-109618. Neither setting replaces the patch. See the
[NVD entry for CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618)
and the [NVD entry for CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619).

Both flaws assume one thing: that an unauthenticated request can reach PHP. Agilicus
AnyX removes that assumption. Every request must match a firewall rule before it
reaches the connector and the application, and AnyX denies any request that matches
no rule. Narrowing those rules is the part most customers can improve today.

Replace broad POST rules with rules that name the path and the people:

 * Replace a catch-all rule such as a path regex of /.* with method all by one rule
   per endpoint, naming the exact path and the method it needs.
 * Attach every POST rule to a named role or group. Allow anyone only on a sign-
   in form, and limit that rule to the exact sign-in path.
 * Require a recent multi-factor authentication proof on administrative and upload
   endpoints, using the maximum seconds condition on the rule.
 * Deny the methods an endpoint does not need. A POST rule on a path that only serves
   pages is unnecessary exposure.
 * Keep the common path prefix consistent, and check that the rules follow it after
   a prefix change.

For connector-hosted applications, the service HTTP configuration includes an Allow
file uploads setting, on by default. Turn it off for an application that never accepts
uploads, and the connector rejects multipart form data with HTTP 415 before the 
request reaches PHP. The proxy decides from the Content-Type header only, so it 
does not inspect the body, and it does not replace the PHP update.

For more information, see [Firewall rules](https://www.agilicus.com/anyx-guide/authorisation-rules/)
and [Web Application Security](https://www.agilicus.com/anyx-guide/web-application-security/).