← Back to Blog

PHP2Shell Vulnerability: LoginTC Is Not Impacted

October 22, 2026 • Thomas Sydorowski

What is the PHP2Shell vulnerability?

PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026 and rated CVSS v4 9.2. They let an attacker run code on a web server running PHP without logging in. PHP versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected, including WordPress, Drupal and Joomla sites.

The NSA warns that this access “could help attackers steal sensitive data, disrupt services, or move deeper into a network.”

Are LoginTC services impacted?

No. LoginTC is not impacted by PHP2Shell. This includes LoginTC Cloud Services, the LoginTC RADIUS Connector, LoginTC Managed and all LoginTC connectors.

How can I protect against PHP2Shell?

Recommendation 1: Update PHP now

Update every PHP installation to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to your Linux distribution’s patched package. PHP says updating is the only complete fix. Remember PHP bundled inside vendor software and appliances.

Recommendation 2: Take unpatched systems offline

If a system can’t be updated right away, the NSA and the UK NCSC both advise taking it offline until it can be.

Recommendation 3: Require MFA on the logins behind your web servers

MFA does not stop PHP2Shell itself. It stops what comes next. Wiz notes that a compromised PHP process may expose passwords, tokens and API keys. With LoginTC on SSH, Windows logon and RDP and your VPN, a stolen password alone won’t get an attacker any further.

Recommendation 4: Rotate secrets and check for compromise

MFA can’t protect API keys, database passwords or active sessions. On any server you can’t rule out, rotate them, end active sessions, and check for new files, web shells and new accounts.

Get support

If you have any questions, contact our support team. Want MFA on SSH, RDP and VPN while you patch? Most organizations deploy LoginTC in under an hour.

← Back to Blog