Skip to content
Products
Platform
Developer Tools
Portal

STACKIT-2026-002: Emergency PHP Patch – CVE-2026-109618 & CVE-2026-109619

Last updated on

Advisory metadata

Section titled “Advisory metadata”
Attribute Value
Advisory ID STACKIT-2026-002
Published date 2026-10-21
Severity Critical
Affected service STACKIT-managed services / self-managed PHP workloads

Overview

Section titled “Overview”

The PHP Security Team disclosed two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), which are known in the industry as “PHP2Shell”. The vulnerabilities affect all PHP versions, at least back to PHP 5, including end-of-life branches, across common PHP deployments such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Exploitation of these vulnerabilities allows unauthenticated threat actors to run malicious code on web servers running PHP applications. A proof of concept is publicly available, and attempted exploitation, including attempts prior to the publication of the patches, has been reported. The vulnerabilities are addressed in the security releases PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; the PHP Security Team additionally provides backport patches for the end-of-life versions 7.4, 8.0, and 8.1.

Affected versions

Section titled “Affected versions”

The vulnerabilities affect the following PHP versions:

  • PHP < 8.5.12 (PHP 8.5 branch)
  • PHP < 8.4.27 (PHP 8.4 branch)
  • PHP < 8.3.36 (PHP 8.3 branch)
  • PHP < 8.2.35 (PHP 8.2 branch)
  • PHP 5.x–7.3 (end-of-life; no fix available)

The PHP Security Team provides backport patches for the end-of-life versions 7.4, 8.0, and 8.1. End-of-life PHP versions 5.x–7.3 require migration to a supported branch.

Identified CVEs

Section titled “Identified CVEs”

The advisory addresses the following Common Vulnerabilities and Exposures (CVEs):

Required actions

Section titled “Required actions”

Self-managed systems

Section titled “Self-managed systems”
  • Inspect all self-managed PHP installations, including PHP embedded in third-party products such as firewalls, routers, and network appliances with PHP-based web interfaces, for affected versions.
  • Apply security updates to upgrade to one of the resolved versions: PHP ≥ 8.5.12, ≥ 8.4.27, ≥ 8.3.36, or ≥ 8.2.35, or apply the vendor or distribution backport patches for the end-of-life versions 7.4, 8.0, and 8.1.
  • Migrate the end-of-life PHP versions 5.x–7.3 to a supported branch.
  • Restrict network access to PHP web servers to authorized client hosts and internal networks, and apply Web Application Firewall rules until patching is complete (public rulesets for these vulnerabilities are referenced in the BSI warning).

STACKIT-managed services

Section titled “STACKIT-managed services”
  • Platform updates: STACKIT initiated platform updates for the affected services to apply security patches across the service infrastructure.
  • For applications running on STACKIT Cloud Foundry: review the PHP version used by your applications and update to one of the resolved versions.

References

Section titled “References”

Contact and support

Section titled “Contact and support”

For questions regarding this advisory or assistance with system configuration, contact STACKIT Support:

  • Open a ticket through the STACKIT Help Center.
  • Contact the support team by email at cybersecurity@stackit.cloud.