PHP2Shell: What MSPs should do now

Understand the vulnerability and the customer's exposure

PHP2Shell refers to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. PHP's maintainers identify installations serving web requests as at risk, with the highest risk associated with Apache's mod_php configuration. In a demonstrated attack, exploitation can occur before the application's code runs.

For MSPs, the first challenge is finding the affected installations. Customers may know which websites they operate, but have little visibility into the components embedded in their applications and appliances. Build an inventory, establish which services are reachable, and check the relevant supplier advisories.

Network security devices: Check the management interface

Network security devices require particular attention because PHP may support their management interface. Exposure and impact depend on the product, version, and configuration.

Palo Alto Networks, for example, identifies the PAN-OS management web interface as affected, while stating that GlobalProtect portals and gateways are unaffected. Its current product assessment identifies availability as the impact. These distinctions matter: MSPs need to explain the risk associated with the customer's actual deployment.

Check whether affected management services are accessible from the internet or from networks that do not need administrative access. Where access is unnecessarily broad, restrict it immediately.

Endpoints: Look for bundled PHP

The endpoint review should include servers and workstations running software that bundles PHP, including local web services and development environments. Finding a PHP executable should trigger an investigation into how it is used and who can reach the service. Huntress specifically recommends checking vendor appliances and Windows software that bundle PHP.

Where exploitation enables code execution, the potential consequences include data theft, malware installation, and access to other systems. Assess the permissions held by the affected service and the customer resources available to it.

Patch promptly—and verify the fix is running

PHP released fixes on 21 October in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Linux distributions and support providers may supply backported fixes, so confirm package status against their advisories. PHP's maintainers state that configuration changes do not completely resolve these vulnerabilities.

MSPs should prioritise internet-facing systems and exposed management interfaces, then work through the remaining affected estate. A practical patching process should:

• Identify the supported update. Use the appliance or application vendor's approved process for bundled PHP.
• Prepare for recovery. Back up configurations and check service dependencies.
• Deploy and verify. Restart affected services as required and confirm that the running instance contains the fix.
• Track outstanding exposure. Include redundant appliances, containers, and systems that may return to service later.

Where a fix is unavailable, apply the vendor's mitigations and restrict access. If exposure cannot be adequately reduced, consider taking the affected service offline until it can be secured. Give customers a clear account of what remains exposed and the next action required.

Add layers of defence

Patching addresses the vulnerability. Additional controls reduce opportunities for exploitation and limit what an attacker can reach.

Restrict management access to approved administration systems, segment management networks, and limit service accounts to the permissions they require. Review endpoint detection coverage across both Windows and Linux systems, including web servers.

Apply relevant WAF and intrusion prevention updates, and verify that the affected traffic passes through those controls. This is particularly important for appliance management services. Palo Alto Networks' guidance, for example, specifies routing and decryption requirements for threat prevention to inspect management traffic. Having a security feature enabled does not, by itself, establish that the vulnerable service is protected.

Treat these controls as additional protection while completing and verifying remediation.

Continue monitoring after patching

The patch date should not become the starting point for an investigation. AWS reports observing a PHP2Shell exploitation attempt on 17 October, four days before public disclosure. MSPs should therefore review activity from before the update as well as continue monitoring afterwards.

Investigate unexpected file changes, unusual outbound connections, and PHP or web-server processes launching shells, interpreters, or download tools. Review appliance and web-server logs alongside endpoint telemetry, and preserve evidence when suspicious activity appears. These behaviours warrant investigation even when no vulnerability-specific signature fires.

Patching is essential, but it cannot establish whether an attacker gained access earlier. An intruder may already have installed a webshell, created an account, or established another means of persistence. Continued monitoring and detection help MSPs find that foothold, contain the intrusion, and protect the customer after the immediate patching work is complete.