TL;DR

• If you are mid-patch right now, here is where your vendors stand. Within a day of the PHP2Shell fixes, five vendors we work with had published guidance or protections: Cloudflare, AWS, Microsoft, Check Point and Tenable. We found nothing PHP2Shell-specific yet from most of the rest, including Akamai, Palo Alto Networks, Fortinet, F5 and Barracuda.
• Everyone agrees on the basics: patch PHP first, treat firewall and IPS rules as a short-term cover, and plan to retire PHP 8.1 and older, which get no upstream fix.
• This is a snapshot from 22 October 2026 and it will change. We are checking vendors alongside our customers this week, and we are happy to help you check yours.

Where Things Stand

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4. They can allow unauthenticated remote code execution, and the PHP core team issued an out-of-band security release on 21 October 2026. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We covered the flaws and where edge protection fits in our CISO’s guide to PHP2Shell. This follow-up looks at what each of our vendors has said and done.

We went through our vendors page, more than 50 partners, and searched each relevant vendor’s own advisories, blogs and documentation. Most of the list sells products this flaw doesn’t touch directly, such as awareness training, backup and email security, so we focused on the ones that protect web servers, find vulnerable systems or detect attacks.

Status	Vendors	What it means
Published guidance or protection	Cloudflare, AWS, Microsoft, Check Point, Tenable	Worth reading the vendor notes below
Nothing PHP2Shell-specific found yet	Akamai, Palo Alto Networks, Fortinet, F5, Barracuda, Sophos, Darktrace, Action1, Fortra (Tripwire), Recorded Future, Kaspersky, Seceon	Ask your vendor, or us, whether protections are active
Not directly affected	Awareness, backup, email, identity, OT and most networking vendors	No vendor action needed, but check any PHP on your own servers

Snapshot taken 22 October 2026. Vendor positions change by the hour, and a lack of a public statement doesn’t mean a vendor isn’t protecting you. It means we couldn’t find one.

What Has Been Published So Far

Vendor	What they’ve said or done	What you can do
Cloudflare	Cloudflare’s CTO said PHP sites behind Cloudflare already have an initial set of WAF rules for the known exploit routes, available to all customers including free plans. A security researcher’s write-up reports attackers are already changing their payloads to get past them	Check the managed WAF rules are on and set to block. Treat them as cover while you patch
AWS	Bulletin 2026-143-AWS says AWS services aren’t affected but customer PHP running on them can be. Elastic Beanstalk platform updates came out on 21 October, Amazon Linux has patched packages, and Lightsail needs new instances built from updated blueprints. Amazon’s threat team recorded an exploit attempt on 17 October, four days before disclosure	Update platform versions or packages. If you use AWS WAF, apply the guidance below
Microsoft	The Azure network security team published upgrade guidance and WAF mitigations. A managed rule for Azure Front Door is due to finish rolling out by 28 October, and Application Gateway has a header rewrite mitigation available now	Upgrade PHP, then apply the Azure WAF mitigation that matches your service
Check Point	A Check Point blog, written around the release, says a dedicated IPS protection is expected and recommends putting new critical protections on Prevent, keeping its PHP web shell upload protection active, and temporarily blocking multipart uploads on paths that never accept them	Check gateways get IPS updates automatically, and watch Check Point Advisories for the new protection
Tenable	Tenable published a PHP2Shell FAQ and notes patches are out for supported PHP 8.x branches	Check your Tenable console for current detection coverage and scan your PHP estate

AWS WAF: The Detail

AWS has published specific rules for customers who can’t patch straight away. It says none of them is a complete fix:

• For CVE-2026-109618, use the SizeRestrictions_BODY rule in the AWS Core rule set to restrict request bodies over 8 KB.
• For CVE-2026-109619, AWS published Version 2.3 of its PHP Managed Rule Group, now the default version globally. It also supplied a custom rule that blocks POST requests containing PHP_SESSION_UPLOAD_PROGRESS in the body with PHPSESSID in the body or cookie.
• For old PHP, 5.4 to 8.1, there is no upstream fix. AWS says to apply interim controls and start moving to a supported branch.

Where Akamai, Palo Alto Networks, Fortinet and the Rest Stand

We found no PHP2Shell-specific statement from these vendors at the time of writing. That may simply be timing. Here is what each does in this area, and what to ask:

Vendor	Relevant products	What to ask
Akamai	App & API Protector, Site Shield. Akamai says its Adaptive Security Engine updates protections automatically	Are the protections for both CVEs active on every hostname and set to block? Is the origin locked down?
Palo Alto Networks	Firewalls with threat prevention, and Prisma	Is there a threat signature for the two CVEs, and is it set to block?
Fortinet	FortiGate IPS and FortiWeb	Has FortiGuard released an IPS or WAF signature, and are updates applied?
F5	BIG-IP Advanced WAF and NGINX App Protect	Is there a signature update for these CVEs, and is it in blocking mode?
Barracuda	WAF and WAF-as-a-Service, with a vulnerability database searchable by CVE	Does the database list CVE-2026-109618, and which rule covers it?
Sophos	Firewall IPS, endpoint and managed detection	Is there IPS coverage, and does endpoint detection flag web servers launching shells?
Darktrace	Behaviour-based detection	Can it alert on unusual outbound traffic from web servers after inbound requests?
Action1	Patch management for endpoints	Is PHP on your servers in patching scope, or does it come through the OS package?
Fortra (Tripwire)	Tripwire IP360 vulnerability management	Has the research team released a detection for both CVEs?
Recorded Future, Kaspersky, Seceon	Threat intelligence, endpoint and detection	Is there intelligence or detection content on PHP2Shell exploitation?

What Every Vendor Agrees On

• Patching is the fix. Firewall and IPS rules lower the risk while you patch, though they can be bypassed.
• PHP 8.1 and older has no upstream fix. Move to a supported branch or get a vendor backport.
• Take anything you can’t fix straight away offline or put it behind access control, as the NCSC advises.
• Restart PHP workers after patching and check the running version, so the new code is actually loaded.

What to Hunt For

Check Point’s advice on spotting early signs of attack is useful whichever vendors you use:

Look for	Why it matters
Large or odd multipart POST requests to PHP pages that never take uploads	Early research points to crafted multipart requests reaching PHP before any application code runs
PHP workers crashing or restarting	Memory bugs often crash workers before an exploit works
Web servers starting shells or tools such as sh, bash, curl, wget or python	A common step after a successful attack
New PHP files in web folders, especially upload or cache folders	A sign of a web shell
New outbound traffic from web servers right after inbound requests	Could be the attacker phoning home

Timeline So Far

Date	What happened
17 October 2026	Amazon’s threat team records an exploit attempt on a honeypot, four days before disclosure
20 October 2026	Details leak on social media; watchTowr confirms they are real; PHP announces an out-of-cycle release
21 October 2026	PHP releases fixes; AWS, Microsoft, Check Point, Tenable and Cloudflare publish guidance; CISA and the NCSC issue alerts; watchTowr reports exploitation in the wild
22 October 2026	Vendor guidance keeps updating, with further AWS platform releases due

What We’re Seeing in Practice

What we see most often at times like this:

• Under pressure, “are we protected?” is the natural question to ask a vendor, and the answer is usually a reassuring yes. The more useful follow-up is whether the PHP2Shell protection is switched on, for every hostname, and set to block. We ask ourselves the same thing when we help customers.
• Firewall and IPS updates are available but not yet applied, or applied in detect mode only while teams test, which is understandable when everything lands at once.
• The PHP estate turns out bigger than anyone expected, including supplier-hosted and forgotten systems. That is true of almost every estate we help with.

ITogether’s Independent Verdict

When a flaw like this lands, vendors respond at different speeds and in different ways, and that is normal. What helps most, whether you are a CISO, CIO or CITO, is knowing quickly which protections are live and which are still on the way, and patching regardless. We know that is a lot to juggle in a week like this.

ITogether works with these vendors across the UK, and with many of them in New Zealand and Europe, which is why we can compare what each has published. We are working through this alongside our customers, and we will keep refreshing this tracker as vendors publish more.

👉 Would a second pair of eyes on your vendors’ PHP2Shell protections help? Get in touch.

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com

FAQs

Which Vendors Have Published PHP2Shell Guidance?

As of 22 October 2026, we found guidance or protections from Cloudflare, AWS, Microsoft, Check Point and Tenable. Others may follow, and a lack of a public statement doesn’t mean a vendor isn’t protecting you.

Is a WAF or IPS Rule Enough?

No. Every vendor treats these as short-term cover. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply your vendor’s backport, and restart PHP workers.

What if We Run PHP 8.1 or Older?

There is no upstream fix. Move to a supported branch, get a backport from your distribution or vendor, and put the system behind access control or offline until you do.

How Often Will This Be Updated?

Vendor positions are changing quickly. This is a snapshot from 22 October 2026, and we will update it as more vendors publish. Check the date before relying on it.