PHP2Shell vulnerability: Critical security vulnerabilities in PHP, we will apply the patch as soon as it becomes available

PHP2Shell is the name given by the security community to two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Exploiting these vulnerabilities allows an attacker to execute arbitrary commands on a server. The official security release is scheduled for Wednesday, the 21st of October 2026, at 14:00 UTC (16:00 CEST). We are awaiting the patch and will apply it to our systems as soon as it becomes available.

The two vulnerabilities are located within PHP itself and not in a CMS, plugin or theme. The PHP security team has classified both as critical (CVSS v4.0: 9.2) and describes them as remote code execution vulnerabilities. As details became public prior to the release of the patch, the PHP team has brought forward the release. The team will only publish the list of affected and fixed versions alongside the release. There are no known instances of active exploitation to date.

PHP is used across a large part of the web, and the update is only required at server level. We have promptly assessed the implications for our infrastructure and are prepared. We are currently awaiting the official patch and will deploy it on the affected systems as soon as it is released today at 16:00 CEST (14:00 UTC).

We take security seriously. In such cases, we don’t wait: we act swiftly where necessary and ensure that the systems our customers rely on remain reliable and up to date.