PHP2SHELL - CVE-2026-109618 | CVE-2026-109619
Last updated: October 22, 2026 - 9:20 a.m. (CEST)
Affected CVEs
The security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), these are critical vulnerabilities that could allow an attacker to gain extensive access to the server.
The software vendor (PHP) released security updates on October 21, 2026, at 4:00 p.m. that address the vulnerability in current PHP versions.
Affected PHP Versions
| PHP Branch | Fixed Version |
|---|---|
< 7.4 | ⚠️ No security update is provided |
7.4 | ⚠️ No security update is available |
8.0 | ⚠️ No security update is available |
8.1 | ⚠️ No security update is available |
8.2 | ✅ 8.2.35 |
8.3 | ✅ 8.3.36 |
8.4 | ✅ 8.4.27 |
8.5 | ✅ 8.5.12 |
What do you need to know?
Servers with the "Managed" support level
For all servers with the "Managed" support level, the necessary updates for PHP 8.2, 8.3, 8.4, and 8.5 have already been installed.
If your websites use at least PHP 8.2, no further action is required on your part.
If you are still using a PHP version that has not received a security update, we strongly recommend that you ensure your web application is compatible with at least PHP 8.2.
Servers with the "Unmanaged" support level
If you are operating affected servers at the “Unmanaged” support level, we recommend that you install the security updates as soon as possible to protect your applications and the associated data.
You can find information from the vendor here: https://www.php.net/archive/2026.php#2026-10-20-1
Potential Issues with Deploying the Updates
Please note that due to the extremely high number of affected websites worldwide, the official repository servers may be slower than usual or may temporarily stop responding altogether due to the heavy load.
Regardless, our APT mirror servers already contain the necessary updates and can therefore be used without restriction.
creoline PHP Mirror (Ubuntu + Debian):
https://mirror.creoline.net/php/You can find all the information you need to integrate our repository servers here:
https://help.creoline.com/de/en/doc/apt-repositories-11fsvs6vsI#php
Additional Steps to Secure Your Website
Regardless of this security update, you should ensure that the currently used PHP version is not publicly accessible via the HTTP response headers.
Test via curl:
Run the following curl command from a computer to check whether the PHP version in use is publicly accessible:
curl -sI https://shopware.creoline-demo.com |grep -i php
# Example response if the PHP version is publicly accessible:
x-powered-by: PHP/7.4.33If the curl command returns a response containing the PHP version in use, you should immediately disable this exposure. To do so, add the expose_php = off directive to your active php.ini file.
php.ini:
expose_php = offThen restart the PHP service and run the test again using curl.
Frequently Asked Questions
Will deploying the PHP update cause any downtime?
No, no downtime is expected when deploying the PHP updates.
Is my server on the “Managed” or “Unmanaged” support level?
You can view your server’s support level in the server overview. Managed servers are marked with a green checkmark. This information is also available in the server details view.
How do I determine which PHP version I’m currently using?
- For Plesk-based servers: Change PHP version