php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Operational information last significant change: 21 October 2026 17:25 CEST Software list last status update: 22 October 2026 15:30 CEST TLP:CLEAR

This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619.

PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.

Current status

On 21 October 2026, PHP published fixed releases for CVE-2026-109618 and CVE-2026-109619: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP states that both vulnerabilities can allow unauthenticated remote code execution and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs.

PHP describes CVE-2026-109618 as remote code execution via out-of-memory corruption during request cleanup, and CVE-2026-109619 as remote code execution via stale request-owned global state reused by a later request on the same worker. PHP 8.1 and older are no longer supported by the PHP project; distributions and LTS vendors may provide backported packages, and PHP has published minimal source backports for PHP 7.4, 8.0 and 8.1.

The impact is not limited to websites: PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly.

Recommended actions

• Identify PHP-based applications and their runtime versions, with priority on internet-facing systems and web-serving SAPIs.
• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor-provided backported packages.
• Check third-party images, appliances and embedded runtimes separately; for products that bundle PHP, apply vendor updates as soon as they become available.
• If immediate patching is not possible, follow PHP's temporary mitigations, including disabling session.upload_progress, restarting workers, and reviewing the official memory_limit, post_max_size and PHP 8.5 fatal_error_backtraces guidance. PHP states that these measures are not complete fixes.
• Monitor vendor advisories, internet-facing logs, and public exploit activity.

• CERT-EU Security Advisory 2026-018
• PHP security advisory: Critical remote code execution vulnerabilities, update now
• List of advisories from other EU national CSIRT's

Repository contents

| Directory | Purpose | | --- | --- | | detection_mitigation | Contains detection and mitigation material for the vulnerabilities. | | software | Contains inventory lists of software products with a PHP dependency potentially affected by the vulnerabilities. | | tools | Contains tools for using/generating files within this repo |

Please note that this repository is not complete and is currently being expanded.

Latest software status updates

| Date and time | Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links | |:------------------------|:---------|:--------|:--------------------:|:----------------------:|:----------------------:|:------|------:| |2026-10-22 15:30:07 +0200|QNAP|QNAP Note Station 3|Note Station 3 3.9.14 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.
QNAP QSA-26-18 lists Note Station 3 3.9.14 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|source| |2026-10-22 15:30:07 +0200|QNAP|QNAP QNE (ADRA)|QNE (ADRA) 1.0.7 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.
QNAP QSA-26-18 lists QNE (ADRA) 1.0.7 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|source| |2026-10-22 15:30:07 +0200|QNAP|QNAP QTS built-in PHP runtime|QTS 6.1.0; QTS 5.2.11 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.
QNAP QSA-26-18 lists QTS 6.1.0 and QTS 5.2.11 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed versions are to be announced.|source 1
source 2
source 3| |2026-10-22 15:30:07 +0200|QNAP|QNAP QuMagie|QuMagie 2.10.1 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.
QNAP QSA-26-18 identifies QuMagie 2.10.1 and earlier in its affected-products header for CVE-2026-109618 and CVE-2026-109619; fixed version is not yet published.|source| |2026-10-22 15:30:07 +0200|QNAP|QNAP QuTS hero built-in PHP runtime|QuTS hero h6.1.0; QuTS hero h6.0.x; QuTS hero h5.2.11 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.
QNAP QSA-26-18 lists QuTS hero h6.1.0, QuTS hero h6.0.x and QuTS hero h5.2.11 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed versions are to be announced.|source 1
source 2
source 3|

See the full software status update history.

Contributions welcome

If you have any additional information to share relevant to these PHP vulnerabilities, feel free to open a Pull request. New to this? Read how to contribute in GitHub's documentation.

For updates to the software list: our strong preference is to receive edits in the SPDX source files in software/spdx/. The Markdown list pages are generated automatically from those files. In case this proves too difficult: don't worry. We'll attempt to backport edits in the .md files to the SPDX source files, but without any guarantees.