On October 21, 2026 the PHP project shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both are rated 9.2 on CVSS v4.0 and let an attacker with no credentials run code on servers running PHP 5 through 8. Cloudflare reported exploitation attempts before the fix was out, and CERT-EU and Australia's ACSC told organizations to patch or take affected sites offline. WordPress automatic updates do not install the fix, because the flaw is in the PHP runtime and not in WordPress.
Patching your own servers is your security team's job. Finding out which vendors run PHP, whether they have patched, and whether anyone got in is the vendor risk team's job, and that is the part this playbook covers.
CVSS v4.0 score for both flaws
CVEs: CVE-2026-109618 and CVE-2026-109619
Major versions affected
Reports Radar matched to this story by October 21
The playbook in five steps
Set up steps 1 and 2 once. Steps 3 to 5 run inside a single Radar case.
- Write six questions and attach them to a case portal template.
- Save the outreach email as a Cases email template.
- Open a case from the PHP2Shell signal so the exposed vendors come prefilled, then add your critical vendors.
- Send every vendor the email and a portal link in one pass.
- Track each vendor thread to closed, and turn confirmed exposure into a finding with a remediation commitment.
Why a case and not a mass email: a case gives you one thread per vendor, keeps every reply and status in one place, and exports to Excel when leadership asks where things stand.
Start with the vendors Radar has tied to PHP2Shell plus your critical vendors, then widen. You chase fewer "not applicable" replies while the answers that matter come in.
Build the questionnaire and a case portal template
Go to Configuration → Questionnaires, open the Informational tab and click Create Questionnaire. Rename it PHP2Shell vendor response, then use Actions → Bulk import questions to upload the workbook below, and click Publish.
Then go to Configuration → Portals, click Create template and pick Case follow-up. Name it, set Due in (days) to 7, and choose the questionnaire under Select questionnaire. A Case follow-up template is offered when you send from a case, so it stays out of the way of your regular assessment templates.
The six questions
| # | Question | Answer type |
|---|---|---|
| 1 | Is any product or service you provide to us affected by the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)? | Yes, affected / No, not affected / Still investigating |
| 2 | Which of your products, services or internet-facing systems that support us run PHP, and which PHP versions? | Free text |
| 3 | Have you found any sign of exploitation, unauthorized access, or exposure of our data related to PHP2Shell? | No evidence found / Under investigation / Yes, confirmed |
| 4 | What is your remediation status? | Patched on all affected systems / Mitigated with a compensating control, patch pending / Not started / Not applicable |
| 5 | When will patching be complete on all affected systems? | Date |
| 6 | Who is your point of contact for this incident? | Contact |
Save the outreach email as a template
Go to Configuration → Communications, scroll to Templates and click New email template. Set Template type to Cases and Availability to Shared with my organization. Type @ in the body to insert the Vendor Name and Organization Name variables, so one draft works for every vendor.
Subject: Action required: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure check
Dear {{vendor::name}},
Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) allow unauthenticated remote code execution on PHP 5 through 8. Fixed PHP releases shipped on October 21, 2026, and exploitation attempts have been reported.
Because you provide services to {{org::name}}, please answer six short questions through the secure portal linked below within 7 days: whether you are affected, which systems run PHP, any sign of exploitation, your remediation status and patch date, and a contact for follow-up.
If you are not affected, a one-click "No, not affected" answer is enough.
Thank you,
{{org::name}}Open the case from the signal
Open Radar → Signals and search for PHP2Shell. On the signal, the Exposure tab lists the vendors Radar tied to the event, marked Direct or Nth Party. Click Actions → Create new case. The title, description and affected vendors come prefilled. Use Search and add a vendor to add your critical vendors, then click Create and Continue.
Radar links vendors to an event from news and advisories, uploaded SBOMs and subprocessor lists. A vendor that runs PHP and has never said so publicly will not appear, which is why you add your critical vendors by hand.
No signal in your queue yet? Go to Radar → Cases, click Create case, and add vendors on the case's Vendors tab with Add Vendors to Case or Import vendors from a spreadsheet.
Send the email and portal link to every vendor
After Create and Continue you land on Send Emails. Under Shared Draft Template, pick your PHP2Shell template and click Apply to all pending. Switch on Include a questionnaire portal link in the email and choose your portal template. Check that each vendor has a recipient in To, then click Send all remaining.
If a vendor has no contact on file, close the dialog with Skip and Go to Case, use Source missing contacts on the case's Vendors tab, and come back through Send Emails at the top of the case.
Track every vendor to closed
Each vendor gets its own thread on the case's Vendors tab, with a status, an assignee, a due date and the vendor's replies. Move the status as answers come in.
Thread statuses
| Status | Use it when |
|---|---|
| Email Sent | The vendor has the email and portal link. |
| Response Received | The vendor answered. |
| In Review | You are checking the answer or waiting on a patch date. |
| On Hold | You are waiting on something outside the vendor's control. |
| Closed | The vendor is not affected, or is patched and you have evidence. |
When a vendor confirms it is affected, open its thread and click Actions → Create finding. Then, in Findings, use Request commitment on that finding to ask the vendor for a fix by a date. The vendor accepts and marks the commitment complete through the portal.
Use More → Export as Excel on the case whenever someone asks for status. When every thread is done, click Finalize Case and pick Resolved, Won't fix or False positive.
Common questions
01A vendor says a WAF rule protects them. Is that enough?
Not on its own. Cloudflare's rules were deployed as a stopgap. Record it as "Mitigated with a compensating control, patch pending", keep the thread In Review, and ask for the patch date in question 5.
02What if PHP2Shell is not in our Radar signals?
Use Radar → Cases → Create case and add vendors yourself. You can also log the event with New detector → Log a signal manually so your detectors evaluate it.
03What if a vendor has no contact on file?
Use Source missing contacts on the case's Vendors tab before you send.
04Can we reuse this for the next zero-day?
Yes. Open the questionnaire, use Actions → Clone template, and change the CVE IDs. The email template and case steps stay the same.
Coverbase customers: your team can set up the case and portal template with you and load the vendors Radar has flagged in your environment. Send your approved wording and questions to your Coverbase contact.
