What 1,000,000+ assets under agent coverage showed one week after the fix for CVE-2026-109618 and CVE-2026-109619

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Within a day, FireCompass had a non-intrusive PHP2Shell exposure scan running across the 1,000,000+ assets its agents cover. This report is what that scan, and the agent validation that followed it, found in the first week.

The headline number is 65 percent. Two out of three organisations assessed had at least one web application on a PHP release below the fix line a week after the patch shipped. The more useful number is 48 percent: nearly half of the confirmed exposures disclosed no PHP version at all, which means a header-based check, the method most teams reached for on day one, would have reported them as clean.

What‘s Inside the Report?

• 65% Organizational Exposure: Two-thirds of assessed enterprises had at least one application running a PHP release exposed to PHP2Shell one week post-patch release.

• 48% Hidden Exposures: Nearly half of all confirmed exposures suppressed version strings via proxies, hardened images, or expose_php = Off settings, bypassing traditional header-only scanners.

• 26% False-Positive Rate: 1 in 4 header-based checks resulted in false flags due to soft-404s, SPAs, catch-all routing, and framework version strings.

• Concentrated Vulnerability Distribution: The median affected organization had 3 exposed applications, while 38% had 5 or more exposed assets.

• Runtime Validation Methodology: Details on why version strings are insufficient (vendor backports, worker restarts) and how agent-based runtime validation confirms true exposure safely.

• Actionable Defense Recommendations: Post-incident guidelines covering asset discovery, package-level checks, worker restarts, and mitigation steps.