Question 1

What is PHP2Shell?

Accepted Answer

Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. They can allow unauthenticated remote code execution on PHP installations serving web requests. The flaw is in PHP itself, not in your application code.

Question 2

Which PHP versions are fixed?

Accepted Answer

Upstream fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier get no upstream fix. Check your OS vendor for a backport, or upgrade to a supported branch.

Question 3

Is Apache mod_php more urgent?

Accepted Answer

Yes. PHP reports a demonstrated exploit that can trigger on mod_php before any application code runs. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are also at risk.

Question 4

What does the free Qualys service do?

Accepted Answer

It scans internet-facing assets from the Qualys cloud with InstaScan, validates exploitability with TruConfirm, and provides a mitigation path for EOL/EOS PHP and a patch path where a fix exists. Free for 15 days. No agents required.

Question 5

Does “not exploitable” mean I can skip the patch?

Accepted Answer

No. Validation tells you what to fix first. Updating to a fixed release is still the only complete fix.