Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Privacy

Privacy notice: what this briefing site stores

The pages are static files. There is no account, no comment box, and no first-party analytics product. The only optional third-party script is Google AdSense, and it is not loaded unless a publisher id is configured and you accept the banner.

Last updated

Hosting

The site is meant to be served from a Cloudflare Worker with static assets, on phpvulnerabilities.app. Cloudflare processes connection data, such as IP address and request headers, under the Cloudflare privacy policy. We do not operate a separate request log for editorial purposes.

Version checker

The version tool on the affected-versions page compares the number you type with the published fix versions. The script does not transmit that number. It lives in your browser until you leave the page.

Advertising and cookies

Ad slots render nothing while ADSENSE_CLIENT in the site configuration is empty, which is the default. When a publisher id and at least one slot id are set, the site can request Google AdSense after you choose Accept on the banner. AdSense may set cookies and use personal data to personalize and measure ads. Google describes that processing in its partner-sites policy.

Reject, or ignore the banner, and the AdSense script is not added. The choice is stored in localStorage under the key pva-consent on this origin. That key is not an advertising cookie. Clearing site data for phpvulnerabilities.app removes it.

When ADSTERRA_ENABLED is true in the site configuration, each content page also loads one Adsterra native unit. It is an async script from bauval.org, labeled Advertisement, and it is not the AdSense unit. The AdSense slots stay off until a publisher id is set. The Adsterra script is not held back by the AdSense consent banner. A Google-certified CMP is still not integrated.

Contact mail

If you email contact@phpvulnerabilities.app, the message is handled as ordinary correspondence by whoever operates the mailbox. Do not send passwords, exploit code, or data about a third party. The email field on the overview and contact pages is a placeholder: the browser does not submit it, and this static site has nowhere to store the address.

Children

The site is written for system administrators and developers. It is not directed at children, and we do not knowingly collect personal information from them.

Sources

Outbound links leave this site. We do not host exploit code.

  1. How Google uses information from sites or apps that use our services — Google
  2. Privacy policy — Cloudflare