PHP2Shell: CVE-2026-109618 and CVE-2026-109619
A pair of PHP remote code execution vulnerabilities known as “PHP2Shell”. This page summarizes the fixed versions and a response approach that does not require taking whole systems offline. The CVE record and the PHP project’s own advisory are the authoritative sources; check them for the latest details.
What it is and fixed versions
The two CVEs (CVE-2026-109618 and CVE-2026-109619) are tracked as a remote code execution pair affecting PHP. They are fixed in the following releases; any PHP build older than the fixed release in its branch should be treated as potentially affected:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
How to find affected hosts
Advisedly’s inventory matching is built to compare the PHP versions found on your assets against the CVE’s affected range. Independently of any tool, you can check hosts directly:
php -vdpkg -l | grep -i phprpm -qa | grep -i phpAlso check container images and web-server PHP modules, which can carry a different PHP version than the command-line binary.
What to do instead of a whole-system outage
- Patch or upgrade PHP to a fixed release for your branch, starting with internet-facing hosts, and schedule the rest by exposure.
- Where an immediate upgrade is not possible, follow the mitigation text in the CVE record or the PHP project’s advisory. We do not restate vendor mitigations here so that they cannot drift from the source.
- Record the exception and its target date rather than shutting down systems that cannot be patched today.
Tracking it in the platform
The platform is built to match the CVEs to your inventory and track the work from finding to a POA&M item, to an approved fix, to rescan evidence that the fix landed. We are proving this flow through demos and pilots; it is not a claim about any specific customer environment.
Honest limits
- Distribution backports: Linux distributions often patch PHP without changing the upstream version number, so a version string alone can report a patched host as vulnerable. Confirm against your distribution’s security tracker.
- Known Exploited Vulnerabilities (KEV): at the time of writing, these CVEs are not listed in the CISA KEV catalog. This can change; check the catalog.
- Advisedly does not patch PHP. Remediation is performed by your teams or your vendors.
Questions: begin@advisedly.ai