Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique

On October 21, 2026 the PHP project released fixes for two critical memory-safety flaws (PHP2Shell — CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) that allow unauthenticated remote code execution or disclosure of process memory across many PHP branches (dating back to PHP 5.4.0). The report details the technical root cause, affected/fixed versions, recommended immediate actions (patch and restart workers, inventory, rotate secrets), interim mitigations, detection/hunting guidance for endpoint and edge telemetry, and notes attack attempts observed after an identifier leak but no confirmed in-the-wild compromises as of the report date.