---
title: Added virtual patch for CVE-2026-109618 and CVE-2026-109619
summary: null
url: >-
  https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619
---

Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP version earlier than 8.5.12, 8.4.27, 8.3.36, or 8.2.35, including all releases of 8.1 and earlier. Fastly has combined both CVE-2026-109618 and CVE-2026-109619 into one virtual patch. To activate it and add protection to your services, follow the steps for your control panel below.

## Next-Gen WAF control panel

### Professional or Premier platform

1.   Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).

2.   From the **Sites** menu, select a site if you have more than one site.

3. From the **Rules** menu, select **Templated Rules**.
4. In the search bar, enter `CVE-2026-109618` and then click **View** for the CVE-2026-109618 templated rule.
5. Click **Configure** and then **Add trigger**.
6. Select the **Block requests from an IP immediately if the CVE-2026-109618 signal is observed** checkbox.
7. Click **Update rule**.

### Essential platform

1.   Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).

2.   From the **Sites** menu, select a site if you have more than one site.

3. Click the **Signals** tab.
4. In the search bar, enter `CVE-2026-109618` and then click **View** for the CVE-2026-109618 tag.
5. Click the **Configuration** in the top right corner of the screen.
6. Click the **Detections** tab and then **Add detection**.
7. Verify the switch is set to **Enabled**.
8. Click **Create detection**.
9. Click the **Alerts** tab and then **Add alert**.
10. In the **Status** area, set the switch to **Enabled**.
11. Click **Save alert**.

## Fastly control panel

1.   Log in to the [Fastly control panel](https://manage.fastly.com).

2.   Go to **Security** > **Next-Gen WAF** > [**Workspaces**](https://manage.fastly.com/security/ngwaf/workspaces).

3. Click **Virtual Patches**.
4. In the search bar, enter `CVE-2026-109618`.
5. Click the **Status** switch to the **Enabled** position.
6. _(Optional)_ If your workspace is in blocking mode, choose whether to **Block requests** or **Log requests** if the CVE-2026-109618 signal is observed.
7. Click **Update virtual patch**.