Summary

Paessler is aware of PHP2Shell, two critical remote code execution vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026. After investigating our product, dependencies, and infrastructure, we have found that Paessler PRTG, its third-party dependencies and PRTG Hosted Monitor are not affected. Customers don’t need to do anything for their PRTG installations at this time.

 

About the vulnerability

PHP2Shell affects PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. An attacker who isn’t logged in can trigger it with a single crafted request. The PHP project has released fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. More information can be found here: PHP: News Archive - 2026

 

Impact on Paessler products

  • PRTG Network Monitor and PRTG Enterprise Monitor: Not affected. The PRTG core server, web interface, probes and APIs do not use the PHP runtime, and PRTG does not ship PHP.
  • Third-party dependencies: Not affected. We reviewed the components bundled with PRTG and found no PHP runtime or PHP-based components.
  • PRTG Hosted Monitor: Not affected. Our hosted infrastructure does not run PHP to serve customer instances. As an extra layer of protection, we confirmed that web application firewall rules against known PHP2Shell attack patterns are active.

 

Assessment

Paessler’s security team began assessing our products, hosted services, and corporate infrastructure as soon as the vulnerability was disclosed on October 21. We have put mitigations in place where needed, and we are monitoring for exploitation attempts.

 

Recommendations for customers

PRTG does not need an update. However, because PHP2Shell is serious and widely exploitable, we recommend checking your own environment for PHP-based web servers and patching them to a fixed PHP version. You can use PRTG’s HTTP and service sensors to keep track of those systems while you remediate. Additionally, please monitor this article for updates as they become available.

 

Questions?

Contact security@paessler.com