PHP2Shell: the PHP flaw hiding in hotel phones, networks and sites

PHP2Shell, the nickname for CVE-2026-109618 and CVE-2026-109619, does not target a hospitality product, or even an application: it targets the PHP engine itself, which runs hotel websites and the admin interfaces of many network, telephony and access-control appliances. Patched on October 21, 2026, both flaws are under active exploitation, including against management consoles exposed to the internet, as Palo Alto Networks confirmed on October 28. The question is no longer which product is fragile, but where the estate runs PHP.

Two flaws in the engine, not in an app

CVE-2026-109618 lives in how the PHP interpreter handles out-of-memory errors: triggered remotely, an exhaustion leaves the abandoned request in an invalid state the shutdown routine reads again. In CVE-2026-109619, global state keeps pointing at memory already freed, reread on later requests. Chained, they deliver unauthenticated remote code execution, scored 9.8 on CVSS 3.1 by the NVD. The PHP Group fixed both on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; CISA added the pair to its KEV catalog on October 26 citing real-world exploitation.

Exploitation confirmed outside the lab

Palo Alto Networks disclosed on October 28 that active exploitation targets its PAN-OS management interfaces exposed to the internet: the HTTPS web console and XML API service only, dataplane interfaces affected only when a management profile is attached. No special configuration is required to be at risk, the vendor wrote; GlobalProtect portal, gateway and Clientless VPN are spared, and by October 30 every supported branch had its hotfix. Patched customers, like those keeping administration off the public internet, are not affected. Days earlier Dream documented a chain pairing PHP2Shell with Fragnesia (CVE-2026-46300, Linux kernel, KEV October 28): some twenty servers rooted in the United States, Japan, Taiwan and South Korea, three government-affiliated. Unit 42 counted more than 22.6 million exposed instances potentially vulnerable.

Why hotels sit in the front row

Showcase sites, booking engines, guest portals and back offices run largely on PHP, often outsourced and rarely inventoried. The appliances add to it: phone systems, network access control boxes (NAC), email gateways and lock servers ship with web admin interfaces, often built on PHP and sometimes left open to the internet by remote-support habits, exactly what the confirmed PAN-OS exploitation punishes. The NAC decides which devices reach guest Wi-Fi, operational VLANs or the back office: owning it hands over the network map, not a machine.

Vendors: confirmed or presumed, as of October 30, 2026

• Mitel. Advisory MISA-2026-0008 rev. 6.0 (October 28) confirms MiVoice 5000 R8.4 and earlier, fixed by SecurityPatch_R8.X_20, OpenScape Branch and OpenScape SBC up to V11R3.4.3, MiContact Center Enterprise up to 9.8 SP0 FP1 and MiVoice Connect up to R20.0 SP2, fix or workaround per line. Unify Phone and CloudLink, the cloud services Mitel operates, are declared unaffected. Mitel also shows a banner, "PHP Security Issue: Some Mitel sites temporarily blocked", as an interim measure. Sibling advisory MISA-2026-0010 covers the Brotli decoder flaw CVE-2026-111497, nicknamed node2shell, but spares MiVoice 5000.
• HPE Aruba ClearPass Policy Manager. Bulletin HPESBNW05171 rev. 2 (October 23) declares versions 6.14.1 and below and 6.11.16 and below fully affected. Trap: the version upgrade alone is not enough, the dedicated PHP hotfix, since released for both branches, must be added; HPE asks that guest portals and management interfaces come off public access meanwhile. Other Aruba Networking products are not known to be affected.
• Palo Alto Networks PAN-OS. Confirmed and actively exploited on exposed management consoles; hotfixes for all supported branches.
• Barracuda. The Email Security Gateway, the common hotel mail gateway, is declared unaffected; patches went out for the Backup Service Appliance (firmware 6.7.00), Firewall Secure Connector (3.1.2), SecureEdge and Firewall Insights, cloud services listed as remediated. CVE-2026-115560, the third PHP flaw of the moment, affects no Barracuda product; web hosting is covered in our CVE-2026-109618 sheet.
• dormakaba. Advisory DKSA-26-23-101 (October 23) expressly declares every exos 9300, MATRIX, evolo, exivo, resivo, B-COMM, skyra, EntriWorX, Keyscan, Ambiance and Community line not affected; no product action required. Residual risk is the property’s own PHP, outside the advisory’s scope.
• Presumed exposed: all the rest of the PHP. Every in-house interface, integrator portal and property site on unpatched PHP 8.2 through 8.5 is in the blast radius, and PHP 8.1 and older, out of maintenance, will never be fixed. Absent an official statement, presume a product affected until written proof.

What to do, in order

1. Inventory the PHP system by system and put the two questions that matter to the integrator in writing: which firmware or PHP version is running, and is the admin portal reachable from the internet. Written answer, property by property.
2. Patch to the named build: SecurityPatch_R8.X_20 for MiVoice 5000, the PHP hotfix on 6.14.1 or 6.11.16 for ClearPass, the branch hotfix for PAN-OS, PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for websites, session.upload_progress disabled meanwhile.
3. Admin never on the WAN: trusted internal addresses or a jump box (Palo Alto Networks), dedicated VLAN (HPE); VPN, jump box, secured manufacturer account, anything but the open port.
4. Segment: separate the administration plane from guest and operational VLANs, isolate the guest portal; a breach of a PHP interface should open neither the network nor the floors.
5. Hunt for web shell signs: recently added files in web roots, unexpected child processes of the worker, odd outbound traffic. The KEV listing imposes a deadline and investigation on US federal agencies; critical property systems deserve the same bar.
6. Make hosting providers and appliance operators attest in writing to the builds deployed, property by property.

How to check your own exposure

Three checks, no security team needed. From the outside, note what answers on the property's public addresses: any admin login page that is not the booking site closes immediately. Inside, demand from each maintainer the exact installed version and the openings made for remote support. Monitor the vendors: these advisories update almost daily. When the web's substrate takes on water, the victims are the buildings where small interfaces expose themselves.