The Patch Is Out. For Most Energy Software, It May Not Apply.

What CVE-2026-109618 and CVE-2026-109619 mean for your software supply chain, with exclusive SBOM analysis from Fortress Information Security. 

On October 21, 2026, PHP released emergency fixes for two critical remote code execution vulnerabilities known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2. Both can be triggered by an unauthenticated attacker with no user interaction. Attack attempts were reported the same day.

Updating PHP is the only complete remediation. There is no workaround. But in critical infrastructure, the PHP running in your environment often isn’t yours to update. It ships inside your vendors’ products.

  • 145 SBOMs in the Fortress energy software library contain the PHP runtime
  • 43 vendors and 120 products affected
  • 88% run end-of-life PHP with no official patch

Your code isn’t the problem

PHP2Shell lives in PHP itself, not in your applications. Clean code, hardened plugins, and a strong AppSec program don’t change your exposure. What matters is which PHP runtime is deployed, who maintains it, and whether they’ve actually fixed it.

Fortress checked. Of the 21,652 SBOMs in our North American Energy Software Assurance Database, every PHP runtime version identified was affected, and most sit on branches the PHP project no longer supports.

  • Threat assessment: Which deployments carry the highest risk, and what exploitation does and does not give an attacker
  • Indicators of compromise: Source IPs observed in attack attempts, ready to search against your web, proxy, and WAF logs
  • Mitigation guidance: Fixed versions, interim controls that reduce exposure, and the gaps those controls leave open
  • Exploit analysis: How leaked proof-of-concept code evolved after disclosure
  • MITRE ATT&CK and D3FEND mapping: Attacker techniques paired with defensive countermeasures
  • Exclusive SBOM findings: PHP exposure across energy software, broken down by version and remediation status
  • Supplier verification: The specific evidence to request from vendors and hosting providers before you mark this closed

Who should read this

Security leaders, SOC teams, and third-party risk managers at utilities and critical infrastructure organizations, especially those relying on vendor-managed or internet-facing applications.