When a critical vulnerability hits, security teams need to act fast. Application teams still need to test fixes, manage dependencies and keep services running. The pressure rises while applications remain exposed.
The newly disclosed PHP2Shell vulnerabilities bring that challenge into sharp focus. Radware has developed security signatures to address exploitation attempts and is rolling them out across its cloud services. Radware AI Xploit Shield has also created targeted protections, ready to deploy to customer security policies while teams upgrade PHP.
You still need to patch urgently. With AI Xploit Shield on your side, you can reduce exposure and give your team some breathing room to do it safely.
Two critical vulnerabilities with serious consequences
CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are critical PHP vulnerabilities rated CVSS 9.2. They can allow unauthenticated attackers to execute malicious code or access sensitive information on affected servers. Because the flaws are in PHP itself, updating application code or plugins alone will not resolve them. PHP released security updates on October 21, 2026, and exploitation attempts have already been reported.
From a critical finding to protection ready to deploy
Radware is providing protections through Cloud Application Protection, AI Xploit Shield and its on-premises AppWall and DefensePro solutions. Customers should confirm the applicable protections and rollout status for their deployments with their Radware team.
AI Xploit Shield adds a layer of targeted protection during the critical period between vulnerability discovery and full remediation. Its Shield Creator agent analyzed the vulnerability findings and exploit patterns, then generated custom protections that can be applied through customer security policies.
For PHP2Shell, the agent created signatures targeting the vulnerable multipart upload-progress request pattern and exploit payload families identified in public research. The new signatures cover exploit requests that bypassed earlier protections and are ready to deploy into customer security policies.
This puts "protect first, patch safely" into practice. Security teams can apply targeted protections while application and operations teams upgrade PHP, test compatibility and verify the rollout. Protection against the covered attack patterns can be put in place without waiting for the PHP upgrade to be completed.
Breathing room when it matters most
An available patch does not instantly become a deployed patch. Teams need to identify affected systems, coordinate with application owners and hosting providers, and validate changes before rolling them into production.
With AI Xploit Shield on their side, teams can reduce exposure during that process and gain breathing room to patch safely. The prepared signatures protect against specific attack patterns, while upgrading PHP remains essential to fully address the underlying vulnerabilities.
PHP2Shell illustrates why protection during the patching window matters. Organizations need a way to respond to newly discovered vulnerabilities while the work of permanent remediation is still underway.
Put AI Xploit Shield on your side
If you already use AI Xploit Shield, contact your Radware team now to confirm coverage for your affected applications and deploy the prepared protections to the appropriate policies.
If you use Radware Cloud Application Protection but have not yet added AI Xploit Shield, this is a timely opportunity to strengthen your protection during the patching window.
For organizations exploring Radware for the first time, PHP2Shell offers a concrete example of the value: turning a critical vulnerability finding into targeted protection while teams work on the permanent fix.
Act now to reduce exposure.
Contact Radware to put AI Xploit Shield on your side and give your team breathing room to patch safely.