By SCOUTz Content Team · Published and source-checked October 21, 2026
What has been disclosed
PHP powers many websites and applications. These two PHP flaws can permit unauthenticated remote code execution on an affected server. Exploitability depends on the installation, configuration and application behavior. PHP’s official announcement identifies installations serving web requests as at risk and highlights demonstrated exploitation of Apache mod_php.
Read the PHP security release announcement and both official advisories below before making patch decisions. This notice does not establish exposure or compromise in your environment.
What you should do
Ask the person or provider responsible for your hosting to:
- Identify PHP-based websites and applications within their responsibility.
- Review the PHP advisories and the hosting or operating-system vendor’s guidance.
- Apply the appropriate updates and verify that the running services use the patched software.
- Record the systems reviewed, installed package or release, verification date and unresolved actions.
The PHP project lists 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched releases for their respective branches. Hosting and operating-system vendors may backport fixes: obtain the applicable vendor advisory and package confirmation rather than relying on a displayed version alone. Unsupported branches need an appropriate supported upgrade or vendor-supported remediation path.
A request you can forward
Please review our PHP-based websites and applications for exposure to PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, and confirm whether the required security updates have been applied and are running. Please identify the systems reviewed, the patch or vendor advisory used, the verification date and any systems still awaiting remediation.
How SCOUTz can help
The PHP2Shell exposure scan is available in SCOUTz. Already using SCOUTz? Use the product’s scan to support your exposure review and identify systems that may need further investigation.
Need an exposure scan? Request one from the SCOUTz team. If you received this alert by email, reply to that message. Agree the scope and obtain authorization before any active diagnostics.
A SCOUTz scan supports the evidence-gathering conversation; it does not certify PHP patch status. Every observation needs its source, run date and coverage limits. If the evidence cannot establish a PHP version or patch status, the result remains unknown. Your hosting provider or IT team must verify running software and vendor-backported fixes.
More information
- PHP security release announcement — October 21, 2026
- Official PHP advisory: RCE via out-of-memory corruption (CVE-2026-109618)
- Official PHP advisory: RCE via stale global state (CVE-2026-109619)
Primary sources reviewed October 21, 2026. Vendor guidance can change; consult the current advisory.
Frequently asked questions
Does this alert mean our systems are affected?
No. Your IT team or hosting provider must establish which systems use affected PHP software and whether the relevant fixes are running.
Does PHP2Shell mean our website has been compromised?
No. A vulnerability disclosure or exposure finding does not establish compromise. Evidence of suspicious activity requires a separate investigation.
Can an exposure scan confirm every system is patched?
No. Scan coverage and available evidence limit what can be established. Server-side verification and vendor package records may be needed to confirm patch status.
Who should apply the security updates?
The IT team or hosting provider responsible for the PHP installation should review the advisories, apply the appropriate updates and verify the running services.
Can a hosting vendor fix an older PHP package?
Some vendors backport security fixes. Ask your provider for the advisory and installed package evidence rather than relying on the visible version alone.
How do we request a SCOUTz exposure review?
Contact the SCOUTz team. If you received this alert by email, reply to that message; agree scope and authorization before active diagnostics.
This notice is for awareness and does not mean your systems are affected or have been compromised.
The SCOUTz Team
← All security alerts