# \[Info\] PHP2Shell Critical Vulnerability impact search

**URL:** <https://community.dynatrace.com/t/info-php2shell-critical-vulnerability-impact-search/57335>\
**Category:** Open Q&A\
**Tags:** php, vulnerabilities\
**Created:** [October 29, 2026, 5:52pm UTC](https://community.dynatrace.com/t/info-php2shell-critical-vulnerability-impact-search/57335 "2026-10-29T17:52:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jay\_nelson](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/jay_nelson/32/41586_2.png) [@jay\_nelson](https://community.dynatrace.com/u/jay_nelson)\
**Post date:** [October 29, 2026, 5:52pm UTC](https://community.dynatrace.com/t/info-php2shell-critical-vulnerability-impact-search/57335/1 "2026-10-29T17:52:42Z")

</div>

### PHP2Shell Vulnerability search:

📖 For the PHP2Shell Critical Vulnerability Blog: Please read the official Dynatrace blog [here](https://www.dynatrace.com/news/blog/cve-2026-109618-cve-2026-109619-php2shell-critical-vulnerability-what-it-is-and-what-to-do/), which includes a CVE-2026-109618 & CVE-2026-109619 overview, affected PHP versions, remediation guidance, and how Dynatrace helps identify affected workloads and signs of exploitation. This post will help you leverage Dynatrace to find the Hosts/Processes impacted by these vulnerability.

- RCE via OOM corruption, CVE-2026-109618 ([GHSA-ww8hw-w9fx-j79](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)): out-of-memory handling can interrupt PHP while request data is only partially initialized, causing cleanup to treat invalid data as valid.

- RCE via stale global state, CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)): request-owned state may persist after its memory is freed, allowing a later request on the same worker to use stale state before reinitialization.

The following Notebooks DQL will help you identify impacted Hosts/Processes of the above mentioned vulnerabilities.

```auto
// PHP risk check: find PHP processes, the host they run on, and whether the PHP version is vulnerable or mitigated.

smartscapeNodes PROCESS
| filter iAny(arrayConcat(process.software_technologies.os, process.software_technologies.php)[][type] == "PHP")
| traverse {runs_on}, {HOST}, fieldsKeep:{name, process.software_technologies.os, process.software_technologies.php}
| fieldsAdd process_info = dt.traverse.history[0]

| fieldsAdd technology = arrayConcat(process_info[process.software_technologies.os], process_info[process.software_technologies.php])
| expand technology
| filter technology[type] == "PHP"
| fieldsAdd php_version = technology[version]
| filter php_version != "null"

| fieldsAdd version_parts = splitString(php_version, ".")
| fieldsAdd major = toLong(version_parts[0]), minor = toLong(version_parts[1]), patch = toLong(version_parts[2])

| fieldsAdd first_safe_patch = coalesce(if(minor == 2, 35), if(minor == 3, 36), if(minor == 4, 27), if(minor == 5, 12), 0)
| fieldsAdd vulnerability_status = if(
    (major < 8) or (major == 8 and minor <= 1), "VULNERABLE",
    else: if(major == 8 and patch < first_safe_patch, "VULNERABLE", else: "MITIGATED"))

| fieldsAdd priority = if(vulnerability_status == "VULNERABLE", 1, else: 2)
| fields process.name = process_info[name],
    dt.smartscape.process = process_info[id],
    host.name = name,
    dt.smartscape.host = id,
    php_version,
    vulnerability_status,
    priority

| filter in(vulnerability_status, if(arraySize(array("VULNERABLE","MITIGATED")) == 0, array(""), else: array("VULNERABLE","MITIGATED")))

| dedup {dt.smartscape.process, php_version}
| sort priority asc, php_version desc, host.name asc
| fieldsRemove priority

```

If you would like to use a dashboard instead, download the following json file, and upload as a Dashboard in your environment.

[PHP Vulnerability Assessment.json](https://community.dynatrace.com/uploads/short-url/kVHuG3d2dlZJ33Zff4k22JXPy1s.json) (16.8 KB)

---

<div class="post-metadata">

**Author:** ![AntonPineiro](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antonpineiro/32/49_2.png) [@AntonPineiro](https://community.dynatrace.com/u/AntonPineiro)\
**Post date:** [October 30, 2026, 7:50am UTC](https://community.dynatrace.com/t/info-php2shell-critical-vulnerability-impact-search/57335/2 "2026-10-30T07:50:31Z")

</div>

Hi,

Thank you! You have [some dashboard](https://community.dynatrace.com/t/tips-handling-php2shell-cve-2026-109618-19-how-to-track-and-remediate-with-dynatrace/57204) about that also.

Best regards