Critical21 October 2026
PHP2Shell: two critical PHP vulnerabilities
PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution.
If you use PHP, update your supported release branch.
Fixed versions
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
After updating, restart PHP processes and rebuild containers or server images that still contain the older PHP runtime.
This is an informational security advisory. It does not mean that the current TrustNeva assessment actively tests for PHP2Shell.