Is your organisation exposed to PHP2Shell via hidden containers?

Security teams must look beyond their primary development stacks when assessing exposure to the PHP2Shell vulnerabilities. Horizon3.ai published new research highlighting that organisations often depend on PHP runtimes managed by other teams or providers. This means that simply confirming your internal applications do not use PHP is insufficient for validating safety. The presence of these runtimes in third-party applications creates a significant blind spot for many security operations teams.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involve memory-handling failure patterns. Horizon3.ai states that finding affected PHP establishes a remediation need but does not prove that an exploit will succeed in every environment. The research team has validated that these flaws can be feasibly exploited in practice, but only under specific preconditions. They are still characterising what these conditions mean for real-world exposure.

Context on exploit conditions

The exploitability of PHP2Shell varies significantly based on server integration, application behaviour, and configuration. For the stale-state vulnerability, the demonstrated mechanism involves state surviving one request and being used by a later request handled by the same worker. A working exploit against one environment does not automatically establish identical results elsewhere. Conversely, an unsuccessful attempt does not prove that an affected runtime is safe. Security teams must understand which specific paths were tested and under what conditions.

Who is most at risk

Organisations that do not write PHP applications may still be affected. Third-party applications may bundle their own runtimes, while containers may carry different versions from their hosts. Hosting providers may manage PHP beneath sites whose administrators only see the content-management interface. In fully managed websites, customers may have neither visibility into the PHP runtime nor permission to patch it. With self-managed hosting, the responsibility for ensuring the runtime is patched may sit with the customer.

Our take on the response

Updating the PHP package on a server does not guarantee that a bundled copy inside a product or container has also changed. A statement that a provider offers patched PHP is less useful than confirmation that the patched runtime is serving the application. Horizon3.ai’s attack team is working on a reliable way to validate exposure. They distinguish between demonstrating a capability and making testing suitable for customer environments. Operational effects and coverage definitions are still being refined.

What affected people can do

Teams usually begin by mapping all external dependencies to identify hidden runtimes. Check whether third-party applications bundle their own versions of PHP that might bypass central patching policies. Verify if container images contain outdated components that differ from the host system. Look for signs of targeted phishing attempts that reference this vulnerability to trick staff into revealing credentials. Review access logs for unusual activity originating from managed hosting environments. Ensure that any confirmation of patching includes evidence that the specific runtime is actively serving your application traffic.