PHP2Shell: Haven’t patched yet? Take these steps now to mitigate

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, scored 9.2 and affect most PHP builds; Wiz says PHP runs on 70% of the world’s websites. Cloudflare CEO Matthew Prince said the network is recording “millions” of exploitation attempts, and Amazon Threat Intelligence reported attempted exploitation before public disclosure. PHP Project urges updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; it also advises disabling session upload progress as a mitigation for a separate, configuration-dependent RCE vector until a regular release addresses it.

Analysis

The market mechanism is less “PHP exposure equals a Cloudflare windfall” than a short-lived increase in demand for edge filtering and incident response while customers patch origin servers. Cloudflare can block some exploit traffic at the edge, but it cannot remove the underlying vulnerability; effectiveness depends on customers’ configurations and available rules. The reported attack volume is therefore a usage and sales lead, not evidence of incremental revenue or margin. A Mirai-style botnet also creates a second-order risk: compromised hosts may add abusive traffic and raise mitigation demands across network and hosting providers. PHP’s broad presence should not be conflated with the share of sites running affected versions or exploitable configurations.

Over days to weeks, patch urgency and exploit activity could support security-product conversations, but the revenue signal is unlikely to be separable from normal demand without company disclosure. Over 1–3 months, watch whether incidents persist after patch availability and whether customers report successful edge mitigations. Over 6–18 months, the more durable implication is higher baseline spend on asset inventories, patch management, and managed security—not necessarily a structural winner among vendors.

Contrarian read: public exploit attention can make the near-term threat look larger than realized loss; widespread patch availability and the unusual configuration needed for the additional advisory’s RCE may contain impact. Conversely, untracked legacy systems could prolong the tail. No compelling directional NET trade from this item alone.

Key Decisions for Investors

• No immediate NET position: the article provides no evidence that exploitation is converting into bookings, retention gains, or pricing power.
• Treat NET as a watch item over the next 1–3 months. Upgrade the thesis only if company commentary or reported metrics indicate security-product demand or customer retention improving beyond normal trends; reduce interest if exploit traffic fades without measurable commercial follow-through.
• Monitor for a broader cyber-risk basket catalyst if attacks translate into confirmed compromises or sustained botnet traffic. Prefer evidence of incidents and customer spending over raw scanning or exploit-attempt counts.
• Falsifiers: rapid patch adoption with declining exploit activity weakens the demand thesis; sustained confirmed compromises, prolonged elevated attack traffic, or NET disclosure of meaningful security-product traction would strengthen it. Verify the affected-version footprint and customer exposure before sizing any trade.