Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R05

R05: A web application firewall taken for a patch

Because edge rules went live hours before disclosure and covered most traffic, an operator may treat the filter as the fix, resulting in an unpatched engine behind a filter that mutated payloads and unrouted traffic get past.

Rating 16 high · Likelihood 4 Likely · Impact 4 Major · Kind Security · Acceptance not recorded

Basis. Every vendor said a rule is a stopgap; the claim that a WAF protects is disputed.

The path

Told inPatch at the speed of MetasploitPatch at the speed o…Acted on bySecurity lead and AppSecSecurity lead and Ap…JournalistJournalistCarried byWAF vendors (informer)WAF vendors (informe…Security lead and AppSec (owner)Security lead and Ap…Online shops and payments (bearer)Online shops and pay…RiskR05 A web application firewall taken for a patchR05 A web applicatio…Arises fromA filter in front of an unpatched engineA filter in front of…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
WAF vendorsinformerSaid so themselves.2 risks
Security lead and AppSecownerDecides whether the filter buys time or replaces the update.6 risks
Online shops and paymentsbearerPCI DSS 6.4.2 makes the filter a requirement, which can read as enough.2 risks

What it arises from

The evidence

ClaimStatusFact-checkSources
A web application firewall may provide some protection until systems are patcheddisputedA6 EstablishedCISA BACS Cloudflare
Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 OctoberconfirmedA2 ReportedCloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community
Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safeconfirmedA6 Establishedphp.net oss-security PHP

Treatments

TreatmentStatusWhere
Filter and patch, never filter instead of patchin placeDetection and defence: what blocks php2shell and what shows it

The standards that govern it

FrameworkControlWhat it asksFamily
PCI DSS6.4.2An automated technical solution that detects and prevents web attacks protects public-facing web applicationsManagement-system standards
CIS Controls13.10Perform application layer filteringFrameworks and control catalogues
NIST SP 800-53SC-7Boundary protectionFrameworks and control catalogues
ISO/IEC 27001A.8.20Network securityManagement-system standards
Cyber EssentialsFWFirewalls: boundary protection for internet-facing servicesFrameworks and control catalogues

The stories that tell it

On this site: Detection and defence: what blocks php2shell and what shows it