What Happened
On January 2, 2025, the PHP development team released emergency patches for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution vulnerabilities affecting every PHP installation that serves web requests. The flaws impact PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments. Researchers at Wiz found that AI-assisted analysis turned what might have been theoretical attack vectors into practical exploits, reducing the time between discovery and weaponization.
Timeline
January 2, 2025: PHP project releases patches for both CVEs
Same day: Cloudflare deploys WAF rules to all customers covering known exploit vectors
Current state: PHP 8.1 and earlier versions receive no patches (end-of-life status)
The compressed timeline is critical. You don't have weeks to plan deployment windows. The exploit code is already circulating, and automated scanners are probing for vulnerable endpoints.
Which Controls Failed or Were Missing
Version Management Gap
The PHP project no longer supports PHP 8.1 and earlier versions. If you're running unsupported versions, you have no patch path. This isn't a configuration mistake or a missed security setting. It's a fundamental architecture decision that left systems exposed with no vendor remedy.
Vulnerability Scanning Blind Spots
Traditional static analysis tools didn't flag these issues because the attack surface only becomes exploitable under specific runtime conditions. Your SAST pipeline might have given you a clean bill of health while serving exploitable endpoints.
Patch Deployment Velocity
Organizations with manual patch processes or quarterly update cycles couldn't respond fast enough. The gap between "patch available" and "patch deployed" is where exploitation happens.
What the Standards Require
PCI DSS v4.0.1 Requirement 6.3.1
"Security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs)."
The requirement assumes you're monitoring vendor security bulletins. But monitoring without deployment capability is theater. You need both detection and response.
PCI DSS v4.0.1 Requirement 6.3.3
"All system components and software are protected from known vulnerabilities by installing applicable security patches/updates as follows: Critical or high-security patches (identified according to the vulnerability risk ranking defined at Requirement 6.3.1) are installed within one month of release."
One month is your outer limit for high-severity patches. For critical RCE vulnerabilities in internet-facing services, you need hours or days, not weeks.
NIST 800-53 Rev 5: SI-2 (Flaw Remediation)
"The organization installs security-relevant software and firmware updates within [organization-defined time period] of the release of the updates."
The control requires you to define your own timeline. If your policy says "30 days for critical patches," you're non-compliant the moment you miss that window. More importantly, you're exposed.
ISO/IEC 27001:2022 Control 8.8 (Management of Technical Vulnerabilities)
"Information about technical vulnerabilities of information systems in use shall be obtained, the organization's exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken."
The standard requires evaluation of exposure. For PHP installations serving web requests, the exposure is binary: you're either patched or you're exploitable. There's no partial credit for "we're working on it."
Lessons and Action Items for Your Team
1. Audit Your PHP Footprint Today
Run this command on every server:
find / -name php -type f -exec {} -v \; 2>/dev/null | grep -E "PHP [0-9]"
You need an inventory of every PHP binary, its version, and what it's serving. Include containerized deployments, CI/CD runners, and that forgotten staging environment.
2. Establish Supported Version Requirements
Create a policy: "All production PHP installations must run versions currently supported by the PHP project." As of this writing, that means PHP 8.2 or 8.3. Add this to your tech stack approval process. If a team wants to deploy PHP, they commit to staying within the support window.
3. Build Emergency Patch Capability
Your standard patch cycle doesn't work for zero-days. You need:
- A tested rollback procedure
- Pre-staged binaries for supported versions
- Configuration management that can push updates in hours
- Monitoring that confirms patch deployment, not just that the automation ran
4. Deploy Compensating Controls
Cloudflare deployed WAF rules for the known exploit vectors. If you can't patch immediately, you need network-level mitigations. But understand what you're buying: time to patch, not a permanent fix. WAF rules block known attacks. They don't prevent exploitation through undiscovered vectors.
5. Integrate AI-Assisted Scanning Into Your Pipeline
The Wiz researchers used AI to identify these vulnerabilities. That capability isn't exclusive to security vendors anymore. Consider how you can incorporate AI-assisted code review into your vulnerability management process, but verify every finding. AI accelerates discovery; it doesn't replace human judgment about exploitability and business risk.
6. Test Your Incident Response Cadence
These vulnerabilities were announced on January 2. If your security team was offline for the holidays and your on-call rotation doesn't include patch authority, you lost critical hours. Your incident response plan needs to account for vulnerabilities announced outside business hours, including who has authority to approve emergency changes.
The Verification Step You're Probably Skipping
After you patch, verify the patch took. Don't trust your deployment automation. Run php -v on a sample of production hosts. Check your web server logs for the PHP version string. One misconfigured host can be your breach entry point.
The PHP2Shell vulnerabilities show what happens when AI-assisted discovery meets legacy code: the theoretical becomes practical overnight. Your response time needs to match the new threat velocity.
