Report an affected site or exposure
Seen a server, appliance or product still running a vulnerable PHP build, or signs of compromise? Tell us privately. No ownership verification is needed; every report is reviewed by hand before it counts.
Not php.net · Not NVD · Not CISA
PHP Vulnerability TrackerUnofficial briefing on PHP security vulnerabilities
Security alert
PHP2Shell: upgrade PHP. That is the only complete fix.
CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.
Seen a server, appliance or product still running a vulnerable PHP build, or signs of compromise? Tell us privately. No ownership verification is needed; every report is reviewed by hand before it counts.