EdgeOne Releases Managed Rules to Block PHP2Shell Vulnerability
Since the vulnerabilities were disclosed at 22:00 (GMT+8) on October 21, 2026, scanning and attack traffic exploiting the PHP remote code execution vulnerabilities has surged. This is not a drill. If you are running PHP — all PHP 5.x and 7.x branches, PHP 8.0 and 8.1, as well as any unpatched 8.2, 8.3, 8.4, or 8.5 builds — your server may already be on the attackers' scan lists. To date, EdgeOne has blocked more than 8,000 related attacks.
Overview
On October 21, 2026, the PHP project released an emergency security update fixing two critical vulnerabilities in the PHP interpreter core, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2, and both allow unauthenticated remote code execution. No login is required and no specific application endpoint needs to be exposed: a crafted HTTP request sent to a site is enough to execute arbitrary commands under the privileges of the PHP process.
The PHP advisory states that all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, with the highest risk on mod_php. It also states that there are no complete mitigations and that updating is the only safe choice.
Affected Scope
| PHP branch | Affected versions | Fixed version |
|---|---|---|
| 8.5.x | Earlier than 8.5.12 | 8.5.12 |
| 8.4.x | Earlier than 8.4.27 | 8.4.27 |
| 8.3.x | Earlier than 8.3.36 | 8.3.36 |
| 8.2.x | Earlier than 8.2.35 | 8.2.35 |
PHP 8.1 and older: The PHP project no longer ships updates for these branches and provides only minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1. Installations using distribution packages should contact the distribution vendor or move to a supported PHP 8 branch.
PHP 8.2 reaches end of life on December 31, 2026 and will receive no further security fixes after that date.
EdgeOne Protection
| CVE | EdgeOne coverage | Action |
|---|---|---|
| CVE-2026-109619 | Covered by Managed Rules | Enable Managed Rules with rule ID 4494969309 |
| CVE-2026-109618 | Covered by Managed Rules | Enable Managed Rules with rule ID 4401216559 |
Additionally, it is recommended to use custom rules to block unnecessary multipart requests and oversized request bodies.
Blocking CVE-2026-109618 and CVE-2026-109619 with Managed Rules
Requests exploiting these vulnerabilities must carry the session upload progress field (default field name PHP_SESSION_UPLOAD_PROGRESS). The field does not appear in normal business traffic and cannot be altered without breaking the exploit chain, which makes it a high-discrimination indicator. EdgeOne has released two rules based on this indicator, with rule IDs 4401216559 and 4494969309, categorized under Open Source Component Vulnerabilities. These rules detect and block requests exploiting CVE-2026-109618 and CVE-2026-109619, keeping attack traffic away from the origin server.
Configuration steps:
- Disable Evaluation Mode for Managed Rules.
- Ensure the Open Source Component Vulnerabilities rule group is set to Automatic Protection, which is available on the Standard and Enterprise plans.
- If automatic updates are not enabled, switch to manual protection and set rule IDs 4401216559 and 4494969309 to Block.
Note: On sites with Evaluation Mode enabled, or where Open Source Component Vulnerabilities is set to Manual Protection, these rules run in Observation mode. Attack requests are logged but not intercepted.
Further Mitigating CVE-2026-109618 with Custom Rules
CVE-2026-109618 is triggered by exhausting PHP process memory. In addition to Managed Rules, Custom Rules are recommended to narrow the scope of service exposure, together with a PHP upgrade.
Blocking unnecessary multipart requests
Exploitation of both vulnerabilities happens during multipart request handling. Where certain site paths have no file upload, form submission, or other multipart business traffic, multipart requests to those paths can be blocked outright.
Add a rule under Web Protection > Custom Rules > Precise Matching Rules:
- Match condition: Custom request header, header name
Content-Type, operator Contains, valuemultipart/form-data. - Match condition: Request path, operator Does not equal, value set to the path that actually needs to receive multipart requests, for example
/api/upload. - Action: Block.
Blocking oversized request bodies
Triggering memory exhaustion requires the attacker to feed a large volume of data into the PHP process. Where a site has no business scenario that requires large request bodies, an upper limit can be set on request body length, and anything above it blocked.
Add a rule under Web Protection > Custom Rules > Precise Matching Rules:
- Match condition: Request body, operator Length greater than, value
8192(8 KB). - Action: Block.
Note: The default maximum request body scan length for an EdgeOne security policy is 10 KB. Please upgrade to Enterprise if your service needs to inspect request bodies over 10 KB.
Upgrading PHP to a Fixed Version
Please upgrade your PHP services to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. Also review the memory_limit, post_max_size, and upload_max_filesize settings to avoid allocating excessive memory or request body limits to a single request.
Note: Where an immediate upgrade is not possible, setting session.upload_progress.enabled to 0 can be used as a temporary mitigation. This is not a complete fix: CVE-2026-109619 has more than one path that consumes stale state, and disabling upload progress closes only one of them. It does not replace the version upgrade.