Applies to: PHP installations that serve web requests, as described in PHP’s advisories.
Adaptiva products: Adaptiva’s Support notice states that Adaptiva software, services and infrastructure are not affected and that Adaptiva does not use PHP for any systems.
Summary
On October 21, 2026, PHP released fixes for two critical remote code execution vulnerabilities. PHP’s advisories say updating PHP is the only complete mitigation, and that already-running PHP processes need to be restarted after the update. This article summarizes what the sources say and points to them for detail.
What to do now
- Identify where PHP runs. Include copies bundled in applications, appliances and containers. Your vulnerability scanner or asset inventory can help. Tenable’s FAQ describes how Tenable customers find affected assets.
- Update to a fixed version. PHP released fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For versions PHP no longer updates, check whether your distribution or vendor provides a patched package. For example, Ubuntu’s notice USN-8948-1 lists updated php8.1, php8.3 and php8.5 packages. Distribution packages can keep their old version numbers, so check your vendor’s advisory.
- Use Adaptiva to help deploy the update. Adaptiva customers can use OneSite Patch to deploy software updates to servers and to track deployment status. Plan the restart of PHP services as part of your rollout and follow your maintenance windows.
- If you cannot update yet, see the mitigations in PHP’s advisories for CVE-2026-109618 and CVE-2026-109619. PHP says these reduce exposure but do not replace updating.
- Review exposed systems for signs of compromise, as described in the Canadian Centre for Cyber Security alert.
A separate flaw
CVE-2026-115560 is a different remote code execution vulnerability that the October 21 release does not address. PHP’s October 23 advisory says it can only occur under an unusual combination of configuration and application code, and that PHP will publish a full advisory with its next regular release.
See Adaptiva in Action
This walkthrough shows how to check the compliance state of a patch, create an ASAP strategy and manually submit the latest patch. Watch Adaptiva’s how-to demo, How-to: PHP2Shell Vulnerability Investigation.
Need help?
Visit us at Adaptiva | Support Center.
References
- PHP advisory for CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w.
- PHP advisory for CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp.
- PHP informational advisory, October 23: https://www.php.net/archive/2026.php#2026-10-23-1.
- Canadian Centre for Cyber Security alert AL26-026: https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619.
- Tenable FAQ: https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote.
- Ubuntu notice USN-8948-1: https://ubuntu.com/security/notices/USN-8948-1.
Third-party pages are maintained by their publishers.