Two critical vulnerabilities affecting PHP were disclosed on October 21, raising concerns for organizations running PHP-based websites and applications. Known collectively as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated attackers to execute malicious code on vulnerable servers. With PHP used by almost 70% of websites, the potential reach is significant. As organizations assess their exposure and work to apply the necessary security updates, Baffin Bay is helping customers add an additional layer of protection.
Helping customers respond quickly
Baffin Bay has introduced a new custom WAF rule through its Application Security capabilities, providing a virtual patching layer against known exploit patterns associated with CVE-2026-109619. Importantly, Baffin Bay’s WAF already has protection in place for CVE-2026-109618, using existing blocking mechanisms to help block malicious incoming traffic. Together, these protections can help organizations reduce their exposure while security teams identify affected environments and apply the necessary PHP updates.
However, WAF is not the only layer of defense. Baffin Bay Bot Protection can provide additional protection by helping reduce the attack surface from automated vulnerability scanning and attacks. Using Bot Protection in Always On mode can help stop automated activity. Together, WAF and Bot Protection provide complementary layers of defense that can help organizations respond quickly as new threats emerge.
Protection while you patch
Virtual patching can provide valuable protection, but it is not a replacement for addressing the underlying vulnerability. Baffin Bay recommends that organizations upgrade affected environments to the patched PHP releases, including PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
For security teams facing newly disclosed vulnerabilities, the window between discovery and remediation can be critical. Layered defenses such as WAF and Bot Protection can help reduce exposure during that period, while organizations take the necessary steps to fully remediate vulnerable systems.
