Security & Compliance
October 23, 2026PHP2Shell on Azure: your App Service and WAF audit
PHP2Shell, CVE-2026-109618 and CVE-2026-109619, gives an unauthenticated attacker code execution on any PHP web server below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and was exploited before the 21 October 2026 patches shipped. Azure App Service on Linux patched its built-in runtimes the same day, Windows App Service PHP will never be patched, and the Front Door and Application Gateway mitigations are off by default. An audit for Azure teams.
PHP2Shell
CVE-2026-109618
CVE-2026-109619
Azure App Service
Azure WAF
Azure Front Door
Application Gateway
Azure Container Apps
NIS2
Cyber Resilience Act
CERT-SE
By Falak Mahmood