Any AD or Entra Exposure re: Actively-Exploited PHP Vulnerabilities (PHP2Shell)

No published Microsoft guidance identifies PHP2Shell as a vulnerability in Active Directory Domain Services or Microsoft Entra ID; exposure is direct only where your organization operates an affected PHP runtime, while AD or Entra can be affected indirectly if a compromised PHP application holds directory credentials, tokens, or privileged workload identities.

Microsoft identifies “PHP2Shell” as CVE-2026-109618 and CVE-2026-109619, network-exploitable PHP remote-code-execution vulnerabilities, and recommends upgrading PHP plus using Azure WAF managed rules as compensating protection.^1^

Exposure assessment

• Microsoft Entra ID service: No direct applicability to Entra ID is documented for these PHP CVEs. Entra ID is a cloud identity service, whereas the cited vulnerabilities affect PHP runtimes.
• Active Directory Domain Services: No direct AD DS vulnerability or domain-controller exposure is documented for these CVEs. Assess a domain controller only if unsupported application software—including PHP—was separately installed on it.
• PHP applications using AD or Entra: These require urgent review. Remote code execution in the application’s security context could expose:
  • LDAP bind or service-account credentials
  • Application secrets or certificates
  • Managed-identity or OAuth tokens
  • Entra service-principal credentials
  • Credentials available to the application host

A privileged workload identity can provide an attacker with a path to reconnaissance, privilege escalation, lateral movement, data access, or persistence. Microsoft specifically recommends reviewing and removing privileged role assignments from workload identities.^2^

Actions to take now

1. Inventory PHP installations, prioritizing internet-facing servers, containers, App Service workloads, and applications that authenticate through AD or Entra.
2. Match installed versions against the affected-version ranges in the PHP2Shell advisory, then upgrade affected runtimes. Do not infer applicability from the presence of PHP alone.
3. Apply Azure WAF managed-rule protection where applicable while upgrades are deployed; treat WAF as compensating protection, not a substitute for upgrading.^1^
4. In Microsoft Defender, review Vulnerability Management → Weaknesses for both CVEs and inspect Exposed Devices and Threats. Defender exposes its detection logic per device under Assets → Devices → device → Discovered vulnerabilities → vulnerability → Detection logic.^3^
5. Confirm active-exploitation status against CISA’s Known Exploited Vulnerabilities Catalog, which records vulnerabilities for which CISA has evidence of exploitation.^4^

If an affected PHP host had identity access

Treat its identities and secrets as potentially exposed:

1. Identify every AD service account, Entra application/service principal, certificate, secret, and managed identity available to the host.
2. Review Entra sign-in logs, audit logs, risky workload identities, and risk detections for suspicious sign-ins, credential changes, configuration changes, or unauthorized application-role assignments.^5^
3. Disable a service principal if compromise is suspected, rotate exposed credentials and certificates, and revoke unnecessary permissions.
4. Review privileged accounts and workload identities first. Microsoft recommends least privilege, MFA for administrative users, Privileged Identity Management, and monitoring privileged sign-ins and changes.^6^
5. For on-premises AD, investigate authentication and account-change activity originating from the affected server and rotate any service-account credentials accessible to it.

For Azure-hosted PHP workloads, responsibility depends on the hosting model: customers manage applications in IaaS and remain responsible for application configuration, code security, identities, and access controls across cloud models; Microsoft manages more of the runtime and operating-system stack in PaaS/SaaS.^7^

In short: there is no documented direct PHP2Shell exposure in AD DS or Microsoft Entra ID, but a vulnerable PHP application can become an attack path into either identity environment when it possesses usable credentials, tokens, or privileged permissions.

References

1. Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade ...
2. Configure Microsoft Entra for Zero Trust: Protect engineering systems
3. Vulnerabilities in my organization
4. Known Exploited Vulnerabilities Catalog - CISA
5. Securing workload identities
6. Security operations for privileged accounts in Microsoft Entra ID
7. Shared responsibility in the cloud