# Cato Networks Adds PHP2Shell IPS Signatures After PHP Fixes Two Critical Flaws

> Cato Networks generated IPS signatures for the PHP2Shell flaws in minutes and now blocks matching exploit requests on inspected traffic.

- Published: 2026-10-22T13:06:26+00:00
- Section: Product Launches
- Author: News Desk
- URL: https://newsforagent.com/news/2026-10-22/cato-networks-php2shell-ips-signatures
- Source: [Catonetworks](https://www.catonetworks.com/blog/cato-ctrl-threat-brief-php2shell-protection-at-machine-speed/)

## Key takeaways

- PHP released fixes on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619, two critical PHP2Shell vulnerabilities enabling unauthenticated remote code execution.
- Cato Networks' self-evolving CVE mitigation agent created a proof of concept and generated an IPS signature in minutes, with security researchers reviewing protections before release.
- Cato Networks has more than 4,000 enterprise customers and reported over $350 million in annual recurring revenue in 2025.

[Cato Networks](https://akta.pro/company-profiles/00002ok/cato-networks) has put intrusion prevention signatures for the PHP2Shell vulnerabilities in place, generated in minutes by its self-evolving CVE mitigation agent after PHP released fixes on October 21, 2026. The company said the signatures block matching exploit requests on traffic inspected by its cloud when enabled in blocking mode.

## How Cato Built PHP2Shell Signatures

PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws that can enable unauthenticated remote code execution. Cato Networks said its agent analyzed the patch changes and found behavior that appeared materially different from the publicly circulated alleged exploit, prompting additional research before finalizing signatures. The agent created a proof of concept and generated an IPS signature in minutes, and security researchers review proposed protections before release.

The flaws affect PHP core rather than a single application or plugin. PHP identifies installations serving web requests as at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Cato Networks said the highest demonstrated risk is in Apache mod_php, where an unauthenticated request can trigger exploitation before application code runs, so a login page does not reliably shield the vulnerable processing.

The UK NCSC urged immediate action to identify PHP installations and apply updates. NHS England's alert highlights code execution and sensitive memory exposure, while Canada's Cyber Centre also calls for assessment of products that bundle PHP. Cato Networks said its production systems are not exposed to PHP2Shell, and that initial response telemetry showed scanning with no exploitation attempts identified against customers.

## Cato Networks' Scale Behind the Response

According to akta.pro [company records](https://akta.pro/company-data), Cato Networks reported more than $350 million in annual recurring revenue in 2025, 43% year-over-year growth, and serves over 4,000 enterprises globally. The same records show a $409 million Series G round in June 2025 led by ION Crossover Partners and Vitruvian Partners, and a valuation above $4.8 billion. Cato Networks joined the OpenAI Daybreak Cyber Partner Program in June 2026 to integrate GPT-5.4-Cyber into CVE discovery, prioritization and 45-minute agentic CVE mitigation.

## Earlier Cato Networks Launches

On October 21, 2026, Cato Networks promoted its XOps platform to enrich SIEM workflows with network and security context, enabling faster incident response, according to [Catonetworks](https://www.catonetworks.com/blog/cato-ctrl-threat-brief-php2shell-protection-at-machine-speed/). On October 20, 2026, Cato Networks said its DEM Root Cause Analysis correlates endpoint, network and application signals to identify fault domains for slow applications, adding Network Adapter Metrics and Client Traceroute, according to Catonetworks. On October 13, 2026, Uniti Solutions launched an AI security service powered by Cato Networks to address employee use of AI tools without approval, citing that 78% of AI users bring their own tools to work, according to Investing.com.

## Cato Networks' Next Steps for Customers

Cato Networks said customers should assess and update affected PHP applications and third-party products in their environments, and continue updating affected PHP runtimes. The company also said customers should identify PHP services outside its inspection coverage and protect remaining gaps with an appropriate application-layer control, such as an inbound WAF configured for PHP2Shell.

## Companies in this story

- [Cato Networks company profile](https://akta.pro/company-profiles/00002ok/cato-networks) · website: http://www.catonetworks.com

---
News for Agent · https://newsforagent.com/llms.txt