Patched Isn't Clean: PHP2Shell and the NetScaler SAML Saga

Last updated 28 October 2026.

You've closed the change ticket. The version string now matches the advisory. The dashboard is green. That still leaves the only question that matters: was the box already compromised before you patched it?

That is the thesis of this post, and the last month of edge exploitation keeps proving it. Citrix NetScaler ADC and Gateway have been under active attack since September, with Australian organisations confirmed among the victims. PHP shipped an emergency mid-October release for what the industry has labelled PHP2Shell, working shells turned up on honeypots days later, and on 26 October CISA confirmed active exploitation and told federal agencies to check for compromise, not just patch. Then on 27 October CISA added the Magento flaw known as PolyShell to its exploited list, the same week researchers showed fully patched stores still serving an attacker's loader. Three products, same operational trap: patching an already-compromised host does not make it clean.

In this post we'll walk that story through all three, the CVEs and builds that close them, what exploitation has looked like in the wild, and the detection steps worth finishing before anyone declares the weekend over.

Key takeaways

• PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on 26 October 2026 with forensic triage required, which is CISA saying out loud that patched isn't clean.
• NetScaler CVE-2026-88771 and CVE-2026-88772 are zero-days in KEV, exploited globally and confirmed against Australian organisations. SAML follow-ons CVE-2026-88779 (KEV) and CVE-2026-107406 need later builds than the first patch wave.
• Magento PolyShell (CVE-2026-48356, fixed in APSB26-73) joined KEV on 27 October. Sansec found an attacker's loader on a store with no missing core patches, because the attacker already had an admin account and a backdoor.
• Hunt first, then upgrade to the build that closes the latest CVE in the chain, then rotate secrets from a known-good backup. A green patch ticket is not a compromise assessment.

Patching after a breach is locking the door when the intruder is already inside.

PHP2Shell: emergency release, then working shells

Start with PHP, because the timeline is short enough to make the point without much ceremony. On 20 October 2026 the PHP project pre-announced two critical flaws (CVSS v4.0 9.2). Patches landed on 21 October 2026 as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

CVE-2026-109618 is remote code execution (RCE) via out-of-memory corruption. A memory_limit longjmp can interrupt partially initialised request data (for example during multipart upload parsing). On Apache with mod_php, an unauthenticated request can trigger it before any application code runs. Full RCE has been demonstrated with default settings, and also confirmed on PHP-FPM through application paths. CVE-2026-109619 is a second RCE path via stale global state: a use-after-free across requests after a fatal error, demonstrated against a real-world app on mod_php.

Affected supported branches run 8.5.0 through 8.5.11, 8.4.0 through 8.4.26, 8.3.0 through 8.3.35, and 8.2.0 through 8.2.34. PHP 8.1 and older are end of life with no upstream binary fix (minimal source backports exist for 7.4, 8.0 and 8.1). ASD's ACSC notes PHP 5 onwards may be affected. Scope is every PHP install serving web requests; mod_php is rated highest risk. A third informational advisory, CVE-2026-115560 (23 October), is an unlikely RCE path still mitigated by session.upload_progress.enabled=0.

CISA and ASD's ACSC both published critical alerts. ACSC was not aware of successful Australian exploitation at its 22 October review. CERT-EU notes PoCs are circulating. Then, on 24 October, honeypots run by Adel Karimi recorded 35 shells on PHP 8.4.26 under Apache mod_php, consistent with CVE-2026-109618, from 15[.]204[.]59[.]70 and 162[.]35[.]99[.]94. The chain was four HTTP/1.1 multipart POSTs to / or /index.php with no User-Agent; the resulting /bin/sh ran as a child of the Apache worker.

On 26 October 2026 CISA added both CVEs to KEV with a federal due date of 29 October. The detail worth pausing on is the flag beside them: forensic triage required. Under CISA's new BOD 26-04 guidance, agencies are expected to check whether a system was compromised before the patch went on, not simply to apply it. PHP also hides inside products you might not think of as PHP. Palo Alto Networks lists the PAN-OS management interface as affected and is rolling out hotfixes, and Cisco has listed Expressway among its affected products. If your inventory only counts web servers, it is short.

Interim mitigations help buy time, but only the patched builds close these bugs. Until you can upgrade:

• Set memory_limit=-1 via php_admin_value.
• Keep post_max_size small.
• Set session.upload_progress.enabled=0 in php.ini or the FPM pool (not via ini_set), then restart workers.
• Prefer a cgroup memory limit over RLIMIT_AS.

None of that answers whether someone already got a shell before your change window. That is the same question NetScaler has been asking Australian teams for a month.

A green tick on the change ticket does not mean the appliance is clean.

NetScaler: zero-days, then the SAML follow-ons

If PHP2Shell is the short version of the thesis, NetScaler is the long one: multiple patch waves, confirmed Australian victims, and persistence that survives a version bump.

On 27 September 2026 Citrix disclosed eight CVEs (CTX697096). CISA added CVE-2026-88771 and CVE-2026-88772 to KEV the same day. ASD's ACSC published a critical alert on 28 September and by 30 September had confirmed Australian exploitation, recommending review of evidence since at least 4 September 2026.

CVE-2026-88771 is unauthenticated RCE via improper input validation, with all deployments in scope under default config (CVSS v4.0 9.5, in KEV). CVE-2026-88772 is a memory overflow RCE/DoS when DTLS is enabled, which is the default on VPN vServers (CVSS v4.0 9.5, in KEV). Those two were enough to force the first emergency weekend. Then the SAML follow-ons arrived and moved the goalposts again.

CVE-2026-88779 is an unauthenticated memory-overflow DoS on SAML SP/IdP (CVSS v4.0 8.7), added to KEV on 4 October. CISA notes it may force a reboot that accelerates code previously injected via 88771. Fixed builds start at 14.1-73.41 and 13.1-64.28. CVE-2026-107406, published 8 October, is a SAML SP/IdP memory overflow leading to RCE or DoS (CVSS v4.0 9.5). Earlier patches are not sufficient. Fixed builds start at 14.1-73.46 and 13.1-64.29 (and matching FIPS/NDcPP). It was not in KEV as at 23 October; Citrix was not aware of unmitigated exploits at publication.

First-wave fixed builds for CVE-2026-88771 through 88778 were 14.1-73.37 and 13.1-64.23. That is the build many teams stopped on, and it is also the trap. Unit 42 documented pre-disclosure activity from mid-August, including DTLS exploitation dropping .deb PHP web shells under /vpn/scripts/linux/, and a three-stage log-poisoning chain for 88771 that implants a shell under /var/netscaler/logon/LogonPoint/custom/ and patches httpd.conf to re-enable PHP. Those artefacts do not disappear because show ns version now looks modern.

Two configuration checks belong alongside the upgrade:

• Check SAML exposure with add authentication samlAction (SP) or add authentication samlIdPProfile (IdP).
• CVE-2026-88778 also needs set ns tcpParam -enhancedISNgeneration ENABLED.

That persistence-after-patch lesson did not stay on the appliance. The next day it showed up again in Magento and Adobe Commerce stores.

Magento PolyShell: patched stores get the loader too

The third example arrived on 27 October, when CISA added CVE-2026-48356, the Adobe Commerce and Magento upload flaw known as PolyShell, to KEV. Adobe rates it critical (CVSS 9.6, no authentication required) and fixes it in APSB26-73, covering Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9. Magento is a PHP application, so plenty of Australian online stores are now sitting at the intersection of both stories.

What makes PolyShell fit this post is Sansec's research published on 24 October. A single operator has planted a JavaScript loader on 953 stores since July 2025, mostly Magento, and PolyShell was the way in for an estimated 471 of them. The loader lives in the cms_block database table and fingerprints each visitor, so automated scanners see a clean page while real shoppers can be served the payload. Earlier versions pushed visitors toward a fake Ledger crypto wallet site. And the line every store owner should read twice: one store on Magento 2.4.7-p10, with no missing core patches, picked up the new loader an hour after a clean scan. The attacker had added a rogue admin account in September and a GSocket backdoor a week later. Patching closed the original hole. It did nothing about the account and the backdoor already inside.

Sansec is blunt about it: if your store loads any of the campaign's domains, the attacker can write to your database, and deleting the script does not remove that access.

Defending Against PHP2Shell, Compromised NetScalers and Magento Loaders

The defence section is where the title turns into a checklist. Inventory and version checks first, then hunt for what the patch cannot erase, then remediate in an order that assumes the host may already be someone else's.

• Inventory:
  • Run php -v on every host and container that serves web traffic (PHP is often embedded; see the NCSC-NL php2shell inventory).
  • Target 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  • Take EOL 8.1-and-older offline per CISA.
  • On NetScaler, run show ns version and aim for 14.1-73.46 or 13.1-64.29 so the SAML RCE is covered.
• PHP detection:
  • Deploy CISA's Sigma rule for PHP workers launching shells.
  • Hunt large multipart POSTs to / or /index.php with empty User-Agent. The final request in a successful chain may leave no access-log line.
  • Alert on Apache/PHP workers spawning /bin/sh, curl or wget.
  • Defanged honeypot sources: 15[.]204[.]59[.]70, 162[.]35[.]99[.]94.
• NetScaler compromise assessment: preserve evidence before patching and forward logs to a SIEM, then work through the host indicators Unit 42 published:
  • Look for software packages nobody installed sitting in the appliance's VPN scripts directories.
  • Look for unexpected files in the NetScaler logon and receiver directories.
  • Check the web server configuration for changes that switch PHP execution back on in upload or web directories, or that quietly map innocent-looking stylesheet paths to scripts.
  • Check whether any shell binary has picked up setuid permissions it should not have.
  • In the appliance logs, look for packet engine crash or missed heartbeat messages carrying shell characters, which can point to exploitation attempts.
  • Review outbound and inbound connections against the attacker infrastructure listed in the advisories.
  • The exact file paths, log strings and IP addresses are in the Unit 42 and Citrix advisories in the references below. Hunt with those, not from memory.
• Magento and Adobe Commerce:
  • Install APSB26-73 for PolyShell and APSB25-88 for SessionReaper (CVE-2025-54236).
  • Search cms_block and cms_page for fpCode, se_referrer or localStorage.getItem, and check update_time for the attacker's last write.
  • Look for unexpected files under pub/media/custom_options/ and pub/media/customer_address/ (PolyShell webshells have been disguised as PNG images).
  • Look for any accesson.php and admin accounts nobody recognises.
  • After cleanup, change database, admin and API integration passwords.
  • Defanged loader domains: deepveindrilling[.]com, additionalver[.]com.
• Remediation order:
  • Compromise assessment first.
  • Upgrade to the build that closes the latest CVE in the chain.
  • If compromise is confirmed or suspected, restore from a known-good pre-compromise backup and rotate local passwords, key-encryption keys and TLS certificates.
  • Follow Citrix's suspected-compromise steps.
  • Do not rely on a WAF alone for PHP.

Conclusion

Patched isn't clean. PHP2Shell showed how fast an emergency release can be followed by working shells, and CISA now attaches forensic triage to the patch deadline. Magento PolyShell showed a fully patched store serving an attacker's code an hour after a clean scan. The NetScaler September and October wave showed the longer version: confirmed Australian exploitation, SAML follow-ons that outran the first patch wave, and webshells that stay put after the version string changes. Unauthenticated RCE on internet-facing infrastructure moves from advisory to working exploit in days. Closing the change ticket is necessary. It is not the same as finishing the job.

Inventory what you actually run, hunt for the persistence patterns above, then patch to the build that closes the latest CVE. For NetScaler that currently means 14.1-73.46 or 13.1-64.29 territory, not the first September drop.

If you want a second set of eyes on exposure, need a compromise assessment, or think you may already be dealing with one of these, talk to our incident response team, or ask about penetration testing and managed detection and response.

References

• PHP Foundation, Today's PHP security release: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
• php.net archive 2026: https://www.php.net/archive/2026.php
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• CISA, Critical vulnerabilities in PHP: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• ASD's ACSC, Critical vulnerabilities in PHP: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
• CERT-EU 2026-018: https://cert.europa.eu/publications/security-advisories/2026-018
• NCSC-NL php2shell product inventory: https://github.com/NCSC-NL/php2shell
• Karimi, PHP2Shell RCE evidence 24 Oct 2026: https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-rce-evidence/README.md
• SecurityWeek, PHP2Shell exploitation moves from probes to working shells: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
• BleepingComputer, PHP2Shell flaws exploited in the wild: https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/
• AWS security bulletin 2026-143-AWS: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
• Citrix CTX697096 (CVE-2026-88771 through 88778): https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html
• Citrix CTX697174 (CVE-2026-88779): https://support.citrix.com/external/article/CTX697174/citrix-netscaler-adc-and-citrix-netscale.html
• Citrix CTX697191 (CVE-2026-107406): https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html
• CISA, Critical zero-day vulnerabilities exploited in Citrix NetScaler: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
• ASD's ACSC, Critical vulnerabilities in Citrix NetScaler ADC and Gateway: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products
• Unit 42, NetScaler zero days CVE-2026-88771 and CVE-2026-88772: https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
• CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.27): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• BleepingComputer, CISA confirms PHP2Shell vulnerabilities now exploited in attacks: https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/
• CISA BOD 26-04, Prioritizing Security Updates Based on Risk: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• Palo Alto Networks, Impact of PHP CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks products: https://security.paloaltonetworks.com/CVE-2026-109618
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (27 October 2026): https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
• Adobe APSB26-73, Security update available for Adobe Commerce: https://www.adobe.com/trust/security/products/commerce/apsb26-73.html
• Defender Daily, Exploited PHP flaws reach Palo Alto and Cisco products: https://www.defenderdaily.com/stories/2026/10/php2shell-palo-alto-cisco-products
• Sansec, deepveindrilling.com: Magento CMS block loader hits 953 stores: https://sansec.io/research/magento-cms-block-loader-deepveindrilling