PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

Affected: PHP 8.1 and older no longer get updates from the PHP project. CVE record does not enumerate pre-8.2.. PHP provided minimal source backports for 7.4, 8.0 and 8.1 (branches PHP-7.4/8.0/8.1-CVE-2026-109618-109619). No binaries. See open note vs AWS bulletin 2026-143-AWS.

Affected: <8.2.35 affected; EOL 31 Dec 2026. Both GHSAs: affected <8.2.35; patched 8.2.35. Branch EOL 31 Dec 2026.

Affected: <8.3.36 affected. Both GHSAs: affected <8.3.36; patched 8.3.36.

Affected: <8.4.27 affected. Both GHSAs: affected <8.4.27; patched 8.4.27.

Affected: <8.5.12 affected. Patched 8.5.12. php.net news 21 Oct 2026; ChangeLog lists 22 Oct 2026.

AlmaLinux 8, 9, and 10 all ship affected PHP versions. Patched packages for every stream in production repos.

Fixed (Alpine security tracker).

No date shown on the tracker page. Older Alpine branches (3.21-3.23) and php82 were not confirmed from the tracker.

Fixed for AL2023 php8.2/8.3/8.4/8.5, AL2 php8.2 Extra and AL2027 Preview; No Fix Planned for AL2 core php and AL2023 php8.1.

Separate from the AWS services bulletin. No Fix Planned is a vendor status, not not affected.

Fixed in trixie-security and bookworm-security; forky still listed vulnerable; sid fixed for php8.4.

DSA-6574-1, DLA-4848-1. Tracker also lists php8.2 (unstable) as unfixed.

Security update pushed to stable (severity high).

VuXML entry: affected below fixed versions.

Affected < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. There is no known workaround.

Fixed (php8.4 security update).

RHEL 7-10 directly affected (RHEL 7: only CVE-2026-109619; the vulnerable code required to exploit CVE-2026-109618 is not present). OpenShift Dev Spaces 3 affected at Moderate. Bulletin status Ongoing, impact Important.

RHSB-2026-013. Red Hat rates both Important (CVSS 3.1 8.1). Some updates are already available, with additional updates in progress.

Fixed (Important: php security update).

SUSE overall state Pending, rated important; fixed packages released for SLE 15 SP6 (8.2.35) and SP7 (8.3.36).

Fixed under ESM (USN-8948-2 follows USN-8948-1).

Ubuntu backports keep older version strings, so version-only scanners may report a false positive.

Ubuntu published “PHP2Shell vulnerability: fixes available”. Shown date is not in the source pack; link only.

Ubuntu backports keep older version strings, so version-only scanners may report a false positive.

Fixed packages in stable for alt-php and native PHP; alt-php/ea-php fixes are backports carrying the old version number.

CloudLinux backports keep older version strings, so version-only scanners may report a false positive. CLSA-2026:87070 dated 22 Oct 2026.

All shipped PHP versions are suspected to be vulnerable; updates released for ea-php74 and above.

New DA build released to current and stable channels; PHP 8.2-8.5 bumped, patches added for 8.1, 8.0, 7.4; PHP versions 7.3 - 5.6 does not yet have a patch.

Staff forum post (DirectAdmin Announcements, administrator fln), not a formal advisory.

All PHP versions shipped with Plesk are also affected; fixes available.

Plesk EOL builds keep the same version number and differ by build date, so version-only scanners may report a false positive. The panel's own management engine runs PHP and needed its own fix.

Only the Nighthawk models listed below were found to include PHP components and their actual impact is under review. PHP is LAN/WiFi-only management, not accessible from the Internet by default.

Severity MEDIUM. This advisory will be updated when fixed firmware versions are available.

No other NETGEAR product or service is exposed to these vulnerabilities based on our assessment.

Multiple QNAP products are affected. QNAP is working on fixes, and updated versions will be released as they become available.

QSA-26-18. Interim guidance: keep NAS off the internet, use VPN, restrict management ports.

Advisory status Resolved, severity Critical. The built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low. Synology Drive is not affected.

PHP-based catalog apps (e.g. Nextcloud) are affected via their own container images.

Not Affected. The TrueNAS platform does not ship or use PHP.

Under investigation: CloudGen Firewall, SecureEdge, Cloud Control, Email Gateway Defense, XDR, Security Awareness Training, MSP/Maestro, Backup Service (BBS), Firewall Insights.

Not affected (explicit) for ESG, Cloud-to-Cloud Backup, Cloud Archiving Service, Web Security Gateway/Agent, WAF / Load Balancer ADC / WAF Control Center, WAF-as-a-Service / Active DDoS Protection, Vulnerability Manager, Advanced Threat Protection, Data Inspector, Incident Response & Impersonation Protection, RMM, BarracudaONE, Message Archiver.

IPS protection CPAI-2026-15172 released.

Affected: Under investigation. Several products are still under investigation, including Catalyst Center.

Affected: CSCwx37062. Confirmed vulnerable. No workarounds.

Cisco lists no workarounds. Expressway and Expressway Select (CSCwx37062) fix in 15.5.21 (TBD). Several products remain under investigation.

Affected: Under investigation. Several products are still under investigation, including ISE Portal Builder.

Affected: CSCwx37073; admin auth required; CVSS 6.6. Confirmed vulnerable. No workarounds. Revision 1.4 (Interim).

Cisco lists no workarounds. URWB (CSCwx37073) fix in 27.1.1 (Feb 2027), admin auth required, CVSS 6.6.

Affected: Under investigation. Several products are still under investigation, including WAE.

Affected: All supported versions: NSIP GUI, management-enabled SNIP, Cluster IP GUI/API. Citrix plans to release fixes for all supported NetScaler software versions on October 27, 2026. Mitigation: restrict management access with ACLs (CTX228148).

Citrix plans to release fixes for all supported NetScaler software versions on October 27, 2026. That is a planned date, not a shipped fix in this pack. Until then, restrict management access with ACLs (CTX228148).

Affected: Not impacted per TechZone post. NetScaler Console and SVM are not impacted.

Affected: Listed as Not Impacted in CTX697263. CTX697263 lists the other Citrix on-prem products as Not Impacted. Shown date was not in the fetched text (fetched 2026-10-23).

Affected: Not impacted per TechZone post. NetScaler Console and SVM are not impacted.

Affected: 21.1.0, 17.5.0-17.5.1, 17.1.0-17.1.3. High / CVSS v3.1 8.1.

Affected: 21.1.0, 17.5.0-17.5.1, 17.1.0-17.1.3. High / CVSS v3.1 7.5. Interim: /etc/php.ini.d/K000163821.ini plus httpd restart.

For affected BIG-IP versions (21.1.0, 17.5.0-17.5.1, 17.1.0-17.1.3), F5's interim mitigation is /etc/php.ini.d/K000163821.ini (memory_limit=-1, session.upload_progress.enabled=0, etc.) plus an httpd restart. F5 lists no software fixes (None) in K000163821 as of the pack.

Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable.

Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable.

F5 AI Gateway 1.x is still under research.

Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable.

Under investigation: FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS.

Products confirmed NOT Impacted include FortiOS, FortiProxy, FortiWeb, FortiMail, FortiManager, FortiAnalyzer, FortiSIEM, FortiSandbox, FortiNAC, FortiADC, FortiSASE, FortiAuthenticator and FortiClient (all platforms).

FG-IR-26-186 lists further products as not impacted. Known Exploited: No.

Affected: 6.14.0 and below; 6.11.15 and below. HPESBNW05171 rev 1, status Investigating, severity Critical. CPPM 6.14.1 and 6.11.16 partially mitigate by requiring cluster-admin authentication. HPE scores both CVEs CVSS 3.1 9.8.

CPPM 6.14.1 and 6.11.16 partially mitigate by moving them from an unauthenticated vulnerability to an authenticated vulnerability requiring cluster-admin privileges. Full fixes are still in development. Advisory status Investigating.

No vendor statement found for these CVEs.

No JSA found for these CVEs.

Affect pfSense software installations; concern only if the PHP GUI or Captive Portal is exposed to attackers (GUI is LAN-only by default, Captive Portal off by default).

Hotfix released for two critical PHP vulnerabilities.

Affected: Not the affected surface in the PAN advisory. Only the management web interface is affected; GlobalProtect and Captive Portal are not.

Affected: Not the affected surface in the PAN advisory. Only the management web interface is affected; GlobalProtect and Captive Portal are not.

Affected: All versions; management web interface (HTTPS UI and XML API) only. Product CVSS-B 8.7 (availability-only vector). GlobalProtect and Captive Portal are not affected.

Restrict management to a jump box (management web interface HTTPS UI and XML API; GlobalProtect and Captive Portal are not affected per PAN).

Affected: All versions. Included in PAN advisory of impact on Palo Alto Networks products.

Affected: All versions. Appliance WildFire listed affected; WildFire Cloud is a separate row.

No SonicWall PSIRT advisory or notice found for these CVEs.

Affected: Ran an affected PHP version; taken offline 21 Oct. The legacy MyUTM licensing portal ran an affected PHP version and was taken offline on 21 Oct, with no evidence of exploitation found so far.

Affected: Advisory: no Sophos products are affected. sophos-sa-20261021-php2shell says no Sophos products are affected.

No Ubiquiti statement found for these CVEs.

WatchGuard's initial assessment is that none of our products are affected by this vulnerability. We are continuing to review.

WGSA-2026-0032, severity Informational. This is an initial assessment, not a final not-affected statement.

Zyxel security advisories index had no PHP / PHP2Shell entry when checked.

No Adobe statement found for these CVEs.

Your site is already protected. There is nothing you need to do.

Guidance: update PHP; notes Ubuntu backports keep old version numbers.

Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation. Site owners are responsible for the hosting platform.

Informational PSA-2026-10-20. Not a statement that Drupal itself is or is not affected.

Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable.

Joomla Security Centre had no PHP2Shell entry when checked.

Moodle HQ took its public sites offline as a precaution; We have patched this site and is patching other public/client sites. Urges self-hosters to update PHP.

About Moodle HQ's own hosting, not a Moodle LMS product advisory.

AIO v14.4.1: PHP CVEs. Upgrade to this version now!

Mastodon post (21 Oct 2026): the issue would affect all online PHP servers and operations including Nextcloud.

All Passbolt versions running on an unpatched PHP affected; Cloud, Docker, AWS AMI, OVA, Helm fixed; DigitalOcean fixed, awaiting marketplace review.

Affected: Under investigation. AppDynamics SaaS is still Under Investigation.

Affected: Under investigation. Smartlook is still Under Investigation.

Affected: Under investigation. Splunk OnCall is still Under Investigation.

Affected: No products currently known affected; Splunk OnCall, AppDynamics SaaS and Smartlook under investigation. Currently, no Splunk products are known to be affected. Splunk OnCall, AppDynamics SaaS and Smartlook are still Under Investigation.

Currently, no Splunk products are known to be affected. Splunk OnCall, AppDynamics SaaS and Smartlook are still under investigation, not a flat not affected.

All customer sites are running fully patched versions of PHP.

Customers are protected because we have released security updates; Adaptive Security Engine rule 3000991 v1.

WAF mitigation only; it does not replace patching PHP.

Affected: Bulletin 2026-143-AWS. AWS services are not impacted (bulletin 2026-143-AWS).

AWS published a separate blog on using AWS WAF to apply mitigations for CVE-2026-109618 and CVE-2026-109619. AWS services themselves are not impacted per bulletin 2026-143-AWS.

Affected: Under investigation. Several products are still under investigation, including Meraki Dashboard.

WAF protections deployed about 9 hours ahead of public disclosure; 22 Oct emergency release renamed seven existing rules to the CVE IDs. Detection logic and rule actions remain unchanged.

WAF mitigation only; it does not replace patching PHP.

Official Images have already been updated and released to Docker Hub and mirrored to Amazon ECR; DHI updated.

Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable.

Virtual patch available covering both CVEs (opt-in).

WAF mitigation only; it does not replace patching PHP.

Users of this language running on Google Cloud may be vulnerable. Some workloads may be auto-patched on App Engine Standard / Cloud Run with automatic updates.

GCP-2026-070.

While Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable.

GCP-2026-070.

Fixed PHP versions available; Redeploy your apps to pick up the fixed versions.

Resolved: All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches.

Linux built-in PHP images patched in Latest and Standard channels (Extended later). Windows built-in PHP runtimes are EOL: No security patch for these runtimes is currently planned. Older Alpine-based WordPress images will not receive these security patches.

Azure WAF managed rule rollout expected to complete by 28 October 2026, per Microsoft Tech Community (updated 22 Oct 2026).

Affected: Cloud service. Cortex XCORE was patched on 21 Oct.

Affected: Cloud service. WildFire Cloud was patched on 22 Oct.

PHP applications hosted on Scalingo are potentially affected; all four fixed PHP versions now available; router blocks multipart requests by default.

Upsun Cloud has patched every php runtime image from PHP 7.4 to 8.5 and redeployed the affected environments; composable image update still in progress.

WAF protections deployed before disclosure; do not replace patching.

WAF mitigation only; customers still need to upgrade PHP.