On October 21, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Either one can let an attacker run code on a PHP web server without logging in. Security vendors report public proof-of-concept code, and some researchers report attacks, though others have not confirmed them. Treat unpatched, internet-facing PHP servers as a priority.
Adaptiva does not use PHP for any systems, but your servers may be affected. Here is what to do:
- Identify where PHP runs, including copies bundled inside other applications, appliances, and containers.
- Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to your vendor’s patched package, and restart PHP processes that are already running, as PHP’s advisories describe.
- Use Adaptiva to help deploy the update. Adaptiva customers can use OneSite Patch to deploy software updates to servers and to track deployment status. Plan the restart of PHP services as part of your rollout, and follow your maintenance windows.
- Review exposed systems for signs of compromise, as described in the Canadian Centre for Cyber Security alert.
The PHP project no longer updates PHP 8.1 and older, but some distributions, including Ubuntu, list patched 8.1 packages in their notices. If you run one, check your vendor’s advisory and plan a move to a supported version. A third flaw, CVE-2026-115560, is not addressed by the October 21 release. PHP’s October 23 advisory covers it.
For more details, read How to Respond to PHP2Shell.
Adaptiva customers can also find our official statement on the Adaptiva | Support Center.
See Adaptiva in Action
Watch How-to: PHP2Shell Vulnerability Investigation to see how to check the compliance state of a patch, create an ASAP strategy, and manually submit the latest patch.
In Closing
Every day between disclosure and patching is a day of exposure, which is why the time-to-exploit window matters. Read more in Cyber Resilience Depends on Closing the Time-to-Exploit Gap.
Sources
- PHP advisory for CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- PHP advisory for CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- PHP informational advisory, October 23: https://www.php.net/archive/2026.php#2026-10-23-1
- Canadian Centre for Cyber Security alert AL26-026: https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
- Tenable FAQ: https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
- Ubuntu notice USN-8948-1: https://ubuntu.com/security/notices/USN-8948-1
