PHP2Shell is a pair of critical flaws in PHP that may impact medical devices and that let an attacker take over a web server without logging in. Patches landed on October 21, 2026 but attackers were probing before that, and most medical device manufacturers have yet to say whether their products are affected. For Biomed and HTM teams, the job right now is simple: find where PHP lives in your clinical environment, and connect with vendors.
What is PHP2Shell?
PHP2Shell is two memory-handling bugs in the PHP engine itself, not in any one application built on it. A crafted web request can push PHP into an error state that it doesn’t clean up properly, and an attacker can use the leftover memory to run their own code. Because the flaw sits in the runtime, an application with perfectly clean code can still be exposed.
| Item | Detail |
|---|---|
| CVEs | CVE-2026-109618 (out-of-memory corruption), CVE-2026-109619 (stale global state) |
| Severity | Critical: 9.2 (CVSS v4.0, PHP security team); 9.8 (CVSS v3.1, NVD) |
| Login needed? | No |
| User interaction? | None |
| Result if exploited | Attacker runs their own code on the server |
| Patch available? | Yes, for PHP 8.2 to 8.5 only (released Oct 21, 2026) |
Does it matter in healthcare?
The hard part isn’t the patch; it’s knowing where PHP is. Vendors bundle it into appliances, management servers and turnkey VMs, and rarely list it on a spec sheet. Researchers quoted by SC Media estimate about 900,000 of the 2.2 million hosts that advertise PHP run end-of-life versions that will never get a fix, and older, long-lived clinical systems fit that profile.
Places PHP commonly hides in a clinical environment:
- Vendor device management and configuration servers
- Medical device middleware and data aggregation servers
- Asset tracking and equipment management portals
- Built-in web login pages on appliances and gateways
- Virtual machines and containers a vendor supplied and maintains
If one of these is taken over, an attacker can steal or alter data, knock the system offline, or use it as a foothold into the rest of the hospital network. When that system feeds clinical workflows, downtime becomes a patient care problem.
Affected and fixed versions
Every PHP version from 5.4 through 8.5 is affected. Only the four supported branches have a fix; anything at 8.1 or older stays vulnerable and needs isolation, replacement or a vendor-supplied fix.
| PHP branch | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| 5.4 to 8.1 | All versions | No upstream fix |
Vendors and Linux distributions sometimes backport fixes without changing the version number, so the vendor’s own bulletin is the final word for their product.
Where things stand
Attackers are actively trying PHP2Shell, healthcare is among the sectors being hit, and national cyber agencies including Canada’s have issued alerts. How many attacks actually succeed is still unclear.
| Date | Source | What happened |
|---|---|---|
| Oct 22 | Sansec | Mass exploitation looks less likely than first feared: public exploits fail on a default PHP install and mostly need a second bug in the app |
| Oct 22 | Check Point | 10% of organizations worldwide saw exploitation attempts; healthcare and medical at 13% |
| Oct 22 | Brandefense | Neither CVE on the CISA Known Exploited Vulnerabilities list, though CISA urged immediate patching |
| Oct 21 | Canadian Centre for Cyber Security | Alert AL26-026 urges upgrading to a supported, patched PHP version |
| Oct 21 | watchTowr | Honeypots caught exploitation of both CVEs in the wild |
| Oct 21 | Endor Labs | PHP releases patches for 8.2 to 8.5 |
| Oct 20 | SecurityWeek | Details leak ahead of planned disclosure |
| Oct 17 | Wikipedia (citing Amazon) | Earliest known exploitation attempt, four days before disclosure |
A note on the popular stopgap: turning off PHP’s Session Upload Progress feature (session.upload_progress.enabled = Off) blocks one known route to CVE-2026-109619, but Tanium notes it does nothing for CVE-2026-109618. Treat it as a speed bump, not a fix.
Have medical device manufacturers responded?
Almost nothing yet. Of the manufacturer security pages checked on October 22, 2026, only Philips had posted anything, and that was a notice that it is investigating.
| Manufacturer | Status as of Oct 22, 2026 |
|---|---|
| Philips | Investigating; details likely to follow on its InCenter customer portal |
| Siemens Healthineers | No information |
| GE HealthCare | No information |
| Medtronic | No information |
| Stryker | No information |
| Hologic | No information |
| Spacelabs | No information |
| ECRI | No information |
Silence isn’t the same as “not affected.” Expect bulletins to trickle out over the coming weeks, and ask your vendors directly rather than waiting.
What Biomed teams should do now
Biomed techs see equipment that IT never does, which makes them the best people to find where PHP is hiding. Five steps:
- List your web-managed systems. Any device, server or appliance with a browser login page is a candidate. Note make, model and software version.
- Ask vendors in writing. Does the product use PHP, which version, and when is a validated fix coming? A dated email gives you a paper trail.
- Don’t patch vendor systems on your own. Unvalidated changes can void support or affect safety. Fixes for regulated systems should come through the manufacturer.
- Reduce exposure while you wait. Work with IT security to make sure these systems aren’t reachable from the internet or general user networks, and limit who can reach their web interfaces.
- Watch and report. Slowdowns, crashes, unexpected restarts or unfamiliar files on a device server should go straight to your security team.
Sources
- Canadian Centre for Cyber Security, Alert AL26-026
- PHP2Shell, Wikipedia
- watchTowr, PHP2Shell intelligence
- Sansec, PHP2Shell research
- Check Point, impact update
- Brandefense, fixed versions and KEV status
- SC Media, CISA advises immediate patching
- Tanium, responding to PHP2Shell
- Endor Labs, patched versions
- SecurityWeek, leak report
- SOCRadar, affected versions and CVSS
Here’s a brief that can help in reporting and sharing with colleagues.
NOTE – this is a rapidly evolving situation and new information is being added regularly. This information is accurate as of the time of publishing but may become stale – it should be validated against other sources as time passes.
vulnbrief.cy4med.ca may have updated information related to the CVE’s in this advisory
Leave a Reply
You must be logged in to post a comment.