Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the first 12 hours after disclosure. In the meantime, Qualys’s configuration-level mitigation reduces exposure to the confirmed attack path without code changes, with or without an agent. WAF, IPS, and EDR […]
Read at Qualys Threat Research Unit
- Vendor
- Qualys, PHP
- Product
- Qualys Cloud Agent, PHP
- EPSS
- 1.00 (p100)
- Fix
- available
- Exposure class
- Network management, Web platform
Why it ranks 41 (Notable)
- EPSS 1.00 (high probability of exploitation)
- Product class: network management, web platform
- Covered by 34 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Qualys Threat Research Unit (blog.qualys.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.