Skip to main content Skip to search Skip to navigation

Security update regarding CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

dephyte e.K.
2026-10-23 03:53:00 / / Comments 0

On 21 October 2026, two critical vulnerabilities in the PHP programming language were publicly disclosed (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2).

Immediately after news of leaks surfaced [1] prior to the scheduled patch release, the store was taken offline as a precautionary measure and was not reactivated until after the security update had been applied to a secure version of PHP. Based on a forensic analysis of the relevant logs and integrity checks, no signs of a compromise were found.

No action is required. If you have any questions, please use the contact form.

References

[1] https://x.com/watchtowrcyber/status/2112611507749982605


News