Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations

Written in collaboration with yuvalpery​ and Gunjan Jain​ 

Introduction

Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP. We strongly recommend that customers upgrade to a patched version of PHP as soon as possible. Upgrading is the only way to fully remediate these vulnerabilities. Read more on the PHP official website.

Microsoft has been part of the coordinated industry response to these vulnerabilities, working alongside the PHP Foundation, Wiz, security researchers, and other industry partners to help protect customers. Azure Web Application Firewall (WAF) has developed mitigations against known exploitation patterns to provide an additional layer of protection while customers apply the PHP security updates. These protections are intended to complement patching and are not a replacement for it. 

About the vulnerabilities: 

1. CVE-2026-109618 – RCE via OOM corruption


2. CVE-2026-109619– RCE via stale global state  

Both vulnerabilities can be exploited over the network without privileges or user interaction, with a high potential impact on confidentiality, integrity, and availability. 

The vulnerabilities relate to PHP handling of memory when a request terminates abnormally, for example due to memory exhaustion or a fatal error. Under certain conditions, improper memory handling could allow an attacker to achieve remote code execution. 

Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. 

Refer to vendor guidancefor patching of different versions of PHP.

Recommended action: upgrade PHP 

We recommend that customers: 

1. Upgrade all PHP deployments to a patched version, including virtual machines, containers, base images, and platform runtimes. We suggest prioritizing internet-facing workloads. 


2. Rebuild and redeploy container images that include their own PHP runtime, since updating the host does not update PHP inside an image. 


3. Migrate to a supported PHP branch if the branch currently in use no longer receives security fixes. 


4. Treat the Azure WAF mitigations below as a temporary, supplementary measure. They address a specific technique and do not remediate the underlying vulnerabilities. 

Azure WAF protection

If you are unable to upgrade PHP to a patched version immediately, apply the following mitigations in the interim –

• Azure Front Door WAF: Apply the mitigation using custom rules for request-side mitigation and enable the managed rule for response-side mitigation.


• Application Gateway WAF: Apply the mitigation using custom rules for request-side mitigation and enable the rewrite rule for response-side mitigation.


• Application Gateway for Container WAF: Apply the mitigation using custom rules for request-side mitigation.

See below sections for details.

Mitigation using custom rules

These custom rules can help reduce exposure to selected request patterns associated with exploitation techniques for these vulnerabilities. Depending on application traffic, the rules may result in false positives and affect legitimate requests. They are intended as temporary mitigations and do not replace the need to upgrade PHP.  Learn more: Azure WAF custom rules for PHP2Shell mitigation. 

Request-side signals alone may not be sufficient to reliably identify certain exploitation attempts. Signals in the server response can provide additional evidence that malicious activity has occurred, enabling more targeted mitigation with higher confidence and lower false positives.  For this vulnerability, Azure WAF identifies known malicious patterns in the session and removes the potentially malicious elements from the response before it reaches the client. This provides an additional layer of protection for supported exploitation scenarios, while patching PHP remains necessary to fully address the underlying vulnerability.  

Azure Front Door WAF: managed rule 

A managed rule to handle potential attack vector in response is currently rolling out for Azure Front Door WAF, expected to complete October 28. Customers who are unable to patch PHP immediately and require interim protection before the rollout completes, contact Microsoft Support to expedite enablement. 

Once the rule is available, its details are as follows: 

• Rule group: MS-ThreatIntel-Response-CVEs 

• Rule ID: 99006001 

• Default state: disabled. Customers need to enable the rule. 

Supported rulesets: DRS 2.0, 2.1 and 2.2. Unlike other WAF rules, this rule does not block or challenge any traffic. When the rule identifies malicious signals in the session that provides strong evidence of exploitation, it removes the potentially malicious elements from the response while leaving the remainder of the response unchanged. Mitigation for this rule takes effect only when the rule action is set to Block on anamoly. Please note that the response side mitigation does not generate WAF log entries or hit counts.   

Application Gateway WAF: rewrite rule

Customers can apply an interim mitigation now using the HTTP header rewrite capability of Application Gateway, which is available on v2 SKUs. A WAF managed rule for Application Gateway is expected to roll out at a later date. Until then, we recommend the following rewrite rule: 

       1. Create a rewrite rule in a rewrite set associated with your routing rule(s). 

       2. Add a condition that evaluates the Set-Cookie response header against the following regular expression: 

^PHPSESSID=(?:[a-zA-Z0-9\-]|%2[Cc])*(?:[^a-zA-Z0-9\-;%]|%(?!2[Cc]))+[a-zA-Z0-9\-]*[^;]+; 

  

          3. Set the action to delete the matching Set-Cookie response header. Alternatively, the header can be set to a replacement value of your choice.                     Please note that setting a value overwrites the entire header, including attributes such as Path=/;. 

 

 Additional considerations: 

• The rule applies only to a Set-Cookie header that matches the pattern. Other Set-Cookie headers in the same response are not affected. 

• We recommend validating the rule on a non-production gateway before broader deployment. 

For further information, see Rewrite HTTP headers and URL with Azure Application Gateway. 

Application Gateway for Containers (AGC):

For PHP workloads behind AGC, upgrading PHP is the recommended remediation. A WAF managed rule for AGC is expected to roll out at a later date. 

Summary 

 

Conclusion 

Following PHP security guidance and upgrading to a patched version is the recommended and complete remediation. Azure WAF mitigations can help reduce exposure during the upgrade period, and we encourage customers to upgrades at the earliest opportunity. 

Changelog

• 10/21/2026 7:00 PM PST – Updated with additional guidance around custom rules