Blog Post

Azure Network Security Blog

5 MIN READ

Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations

saikishor

Microsoft

Oct 21, 2026

Written in collaboration with yuvalpery and Gunjan Jain Introduction Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP. We strongly recommend that customers...

Updated Oct 26, 2026

Version 16.0

azure application gateway

azure front door

azure network security

azure waf

updates

saikishor

Microsoft

Joined February 28, 2025

View Profile

Azure Network Security Blog

Follow this blog board to get notified when there's new activity

Chammi

Copper Contributor

Oct 21, 2026

Attempted the Cookie response header deletion on the App Gateway via rewrite. That started throwing 502s for all requests going through the App Gateway.

Gunjan Jain
Microsoft
Oct 21, 2026
It is possible that the backend is unhealthy.

https://learn.microsoft.com/en-us/troubleshoot/azure/application-gateway/troubleshoot-url-rewrite-rules#cause-3-response-is-generated-by-application-gateway-itself . Can you please try unhealthy BE TSG: Troubleshoot backend health issues in Azure Application Gateway - Azure | Microsoft Learn

Also, this general troubleshooting guide for 502 error may help - Troubleshoot bad gateway (502) errors - Azure Application Gateway - Azure | Microsoft Learn

If this does not help, reach out to support, we will need additional information to troubleshoot the issue.