Fastly incident
Third-Party Vulnerability Disclosure – php2shell (CVE-2026-109618 & CVE-2026-109619)
Ongoing since 07:26 PM UTC, affecting Fastly and Customer Services and 1 more.
A security disclosure regarding php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) was published on October 21, 2026. In addition to implementing certain mitigations, we published a blog post about this disclosure for all customers. The post explains how we responded and shares steps you can take to protect your services. Additionally, we have published a second deep dive blog post to help you navigate and implement your own fixes. What happened? A set of critical vulnerabilities affecting all maintained PHP versions (php2shell) was disclosed, involving how the PHP engine handles fatal errors like memory exhaustion, timeouts, and dropped connections. To help protect customer environments, Fastly’s Security Research team, in collaboration with OpenAI and community partners, has developed a Virtual Patch for CVE-2026-109618 and CVE-2026-109619. To learn more about this vulnerability and our proactive protections, please read the blog posts linked in the reference section below. What you can do We strongly advise taking the following recommended actions: Apply Virtual Patching: Fastly Next-Gen WAF customers are strongly encouraged to apply the Virtual Patch for CVE-2026-109618 and CVE-2026-109619 across all vulnerable Edge and on-prem services. Opting in ensures you automatically receive updates as the rule is refined. Audit Application Servers: Identify all application servers running mod_php or php-fpm and treat all PHP applications as potentially vulnerable. Patch PHP Upstream: Apply official upstream patches. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . For PHP 7.4, 8.0, and 8.1, or older versions, verify available patches with your Linux/package distributor. Fastly is actively monitoring for exploitation and new variants. Please stay aware of any further updates as this situation develops. Customers with any questions, requiring emergency WAF onboarding, or needing support may engage with our Support team through [email protected] or by contacting your designated account management team members. Reference: Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619 Fastly’s Proactive Protection for PHP2Shell, Critical React RCE CVE-2026-109618 and CVE-2026-109619
Affected components
Update timeline
- investigating Oct 21, 2026, 07:26 PM UTC
A security disclosure regarding php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) was published on October 21, 2026. In addition to implementing certain mitigations, we published a blog post about this disclosure for all customers. The post explains how we responded and shares steps you can take to protect your services. Additionally, we have published a second deep dive blog post to help you navigate and implement your own fixes. What happened? A set of critical vulnerabilities affecting all maintained PHP versions (php2shell) was disclosed, involving how the PHP engine handles fatal errors like memory exhaustion, timeouts, and dropped connections. To help protect customer environments, Fastly’s Security Research team, in collaboration with OpenAI and community partners, has developed a Virtual Patch for CVE-2026-109618 and CVE-2026-109619. To learn more about this vulnerability and our proactive protections, please read the blog posts linked in the reference section below. What you can do We strongly advise taking the following recommended actions: Apply Virtual Patching: Fastly Next-Gen WAF customers are strongly encouraged to apply the Virtual Patch for CVE-2026-109618 and CVE-2026-109619 across all vulnerable Edge and on-prem services. Opting in ensures you automatically receive updates as the rule is refined. Audit Application Servers: Identify all application servers running mod_php or php-fpm and treat all PHP applications as potentially vulnerable. Patch PHP Upstream: Apply official upstream patches. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . For PHP 7.4, 8.0, and 8.1, or older versions, verify available patches with your Linux/package distributor. Fastly is actively monitoring for exploitation and new variants. Please stay aware of any further updates as this situation develops. Customers with any questions, requiring emergency WAF onboarding, or needing support may engage with our Support team through [email protected] or by contacting your designated account management team members. Reference: Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619 Fastly’s Proactive Protection for PHP2Shell, Critical React RCE CVE-2026-109618 and CVE-2026-109619
Your product runs on more than Fastly
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services