October 2026 PHP vulnerabilities: Sandfly is not affected

21 October 2026

Two critical PHP flaws are forcing organisations worldwide to patch or take websites offline. Sandfly installations are not affected, and Sandfly is likely to detect attackers using these exploits on the systems it protects.

What happened

On 21 October 2026, the PHP project announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and released an emergency fix.

PHP is the programming language behind a large share of the world's websites. Both flaws are remote code execution (RCE) vulnerabilities: they can let an attacker run their own commands on a web server without needing a password. The flaws were found with the help of AI and had gone unnoticed for years.

Cyber agencies in the US, UK, Australia and Europe told organisations to patch straight away or take PHP sites offline until they could. Several government websites went dark as a precaution.

Is Sandfly affected?

No. Sandfly does not use PHP in any of its components. Neither the Sandfly container image nor the Postgres container image included in our distribution has PHP installed.

How to detect PHP exploit activity on your Linux servers

CVE-2026-109618 and CVE-2026-109619 are PHP remote code execution (RCE) vulnerabilities. Once attackers exploit a PHP RCE flaw, they typically try to open a reverse shell, plant a bindshell backdoor, or set up cron and at jobs so their access survives a reboot. Patching PHP stops new attacks, but it won't remove a backdoor planted before the patch.

Sandfly already detects this class of Linux attack, so it can help you find signs of PHP exploitation across your Linux servers.

"Based on the public information available about how these exploits work, Sandfly is likely to identify them being used to gain shell access on the systems it protects."

Matthew, Chief Architect/R&D USA, Sandfly

Sandfly detections for the PHP RCE vulnerabilities

The following sandflies are among those that may identify malicious activity related to CVE-2026-109618 and CVE-2026-109619.

Reverse shell and bindshell backdoor detection

• process_backdoor_bindshell_network_enabled_parent_www_user
• process_backdoor_bindshell_reverse_generic_1
• process_backdoor_bindshell_reverse_php
• process_shell_running_file_descriptors_php_1
• process_shell_running_file_descriptors_php_2 (disabled by default, see note*)

*Note: process_shell_running_file_descriptors_php_2 is disabled by default because it has a higher risk of false positives. If you run Linux systems with PHP, we recommend enabling it, or running manual scans with it, until you've upgraded to a patched PHP version.

Linux persistence detection against RCE

• file_binary_system_in_www_dir: moving system utilities for future use
• process_persistence_at_jobs_backdoor: re-establish their network sockets after machine reboots.
• process_persistence_cron_backdoor: re-establish their network sockets after machine reboots.
  
  

Questions?

Not using Sandfly yet?