On 21 October 2026, the PHP project released fixes for two critical vulnerabilities in PHP, known together as PHP2Shell. If left unpatched, they could allow an attacker to run code on a vulnerable PHP server without logging in.

We want to keep you informed about how this affects WAF-as-a-Service and what we recommend.

Barracuda WAF-as-a-Service is not affected. The service does not use PHP, so no update to the service is needed.

This advisory is relevant if any of your applications behind WAF-as-a-Service run on PHP.

🔍 About the vulnerabilities

  • CVE-2026-109618 can cause PHP to run out of memory while handling a request, which may lead to code execution.

  • CVE-2026-109619 can cause PHP to reuse memory it has already released, which may also lead to code execution.

Both are rated Critical (9.2 on CVSS v4.0). The PHP fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

 🔒 How WAF-as-a-Service helps protect your PHP applications

  • CVE-2026-109619: We are rolling out additional protection to WAF-as-a-Service applications in stages. You don't need to do anything to receive it.

  • CVE-2026-109618: Request limits block the oversized requests used in the known attack, as long as your application is in Block mode.

  • After an attack attempt: OS Command Injection protections add a second layer of defence.

These protections reduce your exposure to known attack techniques. They support, but do not replace, the PHP update.

 📋 What we recommend you do : No new configuration is needed on WAF-as-a-Service. Please just confirm that Block mode and OS Command Injection Strict are enabled for your PHP applications, and turn them on if they are not.

Step

What to do

1. Update PHP

Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart your PHP services. This is the only complete fix.

2. Check Block mode

Make sure your PHP applications are set to Block mode. In Report mode, attacks are logged but not stopped.

3. Keep OS Command Injection Strict on

This helps stop commands an attacker may try to run on your server.

If you have several PHP applications, we suggest starting with those that are open to the internet.

 💬 Still Need help?

If you see unexpected blocking on a PHP application, or would like us to review your settings, please contact Barracuda Technical Support.

📖 More information

For a fuller explanation of PHP2Shell and how a web application firewall helps reduce exposure, read our blog post.

Read the Barracuda blog → https://blog.barracuda.com/2026/10/23/php2shell-php-exposure-waf-mitigation

 ✅ What happens next

Our security and engineering teams are following this closely. We are continuing to monitor PHP2Shell activity, checking for new attack techniques, and validating further protections for WAF-as-a-Service. We will update this advisory as new information becomes available.

Thank you for your attention, and for keeping your PHP applications up to date.

The Barracuda Application Security Team