Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Exposure reports: aggregate data

1 Approved user reports

Counts of reports that passed manual review. Raw submissions, URLs and contact details are never published. These are self-reported and not a measurement of the internet.

Approved reports: …

Loading…

Submit a report →

2 Outages reported publicly

Separate data source: public outage reports compiled from the PHPocalypse Tracker and news. These are not user submissions. PHPocalypse Tracker (The Unlicense).

53Sites tracked
9Still down
44Back up

Most recent outages

SiteCountryOffline since (UTC)Back up (UTC)DowntimeStatus
LIFULL HOME'SJapan——Down
at homeJapan——Down
SUUMOJapan——Down
French prefecture websitesFrance——Down
CNIL (French data protection authority)France——Down
Autoriteit Persoonsgegevens (Dutch data protection authority)Netherlands——Down
National Land Survey of FinlandFinland——Down
Haaga-Helia University of Applied SciencesFinland——Down
NotuBiz council portalsNetherlands——Down
University of FreiburgGermany21h 01mBack

All times are UTC (24-hour). Duration is the time between the first report offline and the first report back.

Full outage tracker →