Cato CTRL Threat Brief: Cato AI native SASE delivers PHP2Shell protection at machine speed

Cato describes two critical PHP core vulnerabilities (PHP2Shell: CVE-2026-109618 and CVE-2026-109619) that can enable unauthenticated remote code execution and memory disclosure across PHP integrations (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). The report summarizes vendor and national advisories, public PoC activity, Cato’s automated agentic workflow that produced a PoC and IPS signatures in minutes, deployment of cloud IPS protections for inspected traffic, and recommendations to update PHP runtimes and extend inspection/WAF coverage.