Emergency PHP security updates are available for two critical vulnerabilities known as PHP2Shell. Ask your IT team or hosting provider to review your PHP-based websites and applications and confirm that the appropriate fixes are running.
Security Alert | Updated October 21, 2026
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, both reported with severity ratings of 9.2 out of 10.
- Ask your IT team or hosting provider to verify exposure and installed security updates.
- A SCOUTz exposure scan can support review; it does not replace server-side patch verification.
What Has Been Disclosed
PHP is software that powers many websites and web applications. PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, vulnerabilities that can allow attackers to run code on an affected server without logging in.
Tenable's October 21, 2026 FAQ reports that the PHP security team rated both vulnerabilities 9.2 out of 10 under CVSS version 4.0, a standard severity rating. The PHP project's security advisories published on October 21 document the flaws and list patched releases. Exploitability depends on the PHP installation, configuration and application behavior.
What You Should Do
Ask the person or provider responsible for your website hosting to:
- Identify PHP-based websites and applications within their responsibility.
- Review the PHP advisories and the hosting or operating-system vendor's guidance.
- Apply the appropriate security updates and verify that the running services use the patched software.
- Record the systems reviewed, the installed package or release, the verification date and anything still awaiting action.
The PHP advisories list PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched releases for their respective branches. Hosting and operating-system vendors may provide backported fixes. Ask for the applicable vendor advisory and package confirmation rather than relying on the displayed version alone.
A Request You Can Forward
Please review our PHP-based websites and applications for exposure to PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, and confirm whether the required security updates have been applied and are running. Please identify the systems reviewed, the patch or vendor advisory used, the verification date and any systems still awaiting remediation.
How SCOUTz Can Help
We have a scan prepared in SCOUTz to help assess exposure following the release of the security update.
Already using SCOUTz? The scan is ready to help identify systems that may need further review.
Need an exposure scan? Request one from the SCOUTz team. If you received this alert by email, reply to that message to request a scan. Agree the scope and obtain authorization before any active diagnostics.
A scan result needs its source, run date and coverage limits attached. If a scan cannot establish a PHP version or patch status, that result remains unknown. Your hosting provider or IT team should verify the running software and any vendor-backported fixes.
For MSPs evaluating SCOUTz, Join Open Beta.
More Information
- Official PHP advisory: RCE via out-of-memory corruption, published October 21, 2026.
- Official PHP advisory: RCE via stale global state, published October 21, 2026.
- PHP2Shell vulnerability and emergency patch overview, Help Net Security.
- Tenable's PHP2Shell FAQ. Its October 21 pre-release guidance describes expected patches; use the PHP advisories and your vendor's current guidance for patch confirmation.
FAQ
Does this alert mean our systems are affected?
No. Your IT team or hosting provider must establish which systems use affected PHP software and whether the relevant fixes are running.
Does PHP2Shell mean our website has been compromised?
No. A vulnerability disclosure or exposure finding does not establish compromise. Evidence of suspicious activity requires a separate investigation.
Can an exposure scan confirm every system is patched?
No. Scan coverage and available evidence limit what can be established. Server-side verification and vendor package records may be needed to confirm patch status.
Who should apply the security updates?
The IT team or hosting provider responsible for the PHP installation should review the advisories, apply the appropriate updates and verify the running services.
Can a hosting vendor fix an older PHP package?
Some vendors backport security fixes. Ask your provider for the advisory and installed package evidence rather than relying on the visible version alone.
How do we request a SCOUTz exposure scan?
Request a scan from the SCOUTz team. If you received this alert by email, reply to that message; agree scope and authorization before active diagnostics.
This notice is for awareness and does not mean your systems are affected or have been compromised.
The SCOUTz Team
