HIXOR
Threat Intelligence — Vulnerability information
PHP Vulnerability Countermeasures (CVE-2026-109618, CVE-2026-109619: PHP2shell)
The 3 key points
- Summary： IPA has published countermeasure information for two vulnerabilities in PHP: an out-of-memory (OOM) error handling vulnerability (CVE-2026-109618) and a request processing vulnerability (CVE-2026-109619).
- Who is affected： PHP 8.2 series: before 8.2.35
- Recommended actions： Update to a fixed version (8.2.35 for the 8.2 series, 8.3.36 for 8.3, 8.4.27 for 8.4, 8.5.12 for 8.5)
Source and verification
- Source
- IPA (Information-technology Promotion Agency, Japan)
- Original
- Official announcement page (original)
- Published
- October 22, 2026
- Updated
- November 2, 2026
- Last verified by HIXOR
- November 7, 2026 (the date HIXOR checked the original)
This page summarizes an announcement by a public authority. Please check the original for exact details. If this summary and the original differ, the original prevails.
Summary
IPA has published countermeasure information for two vulnerabilities in PHP: an out-of-memory (OOM) error handling vulnerability (CVE-2026-109618) and a request processing vulnerability (CVE-2026-109619). An attack combining the two is known as 'PHP2shell' and may allow remote code execution.
Who is affected
- PHP 8.2 series: before 8.2.35
- PHP 8.3 series: before 8.3.36
- PHP 8.4 series: before 8.4.27
- PHP 8.5 series: before 8.5.12
- Note: Wiz has pointed out that PHP 5.4 and later may be affected by at least one of the vulnerabilities
Recommended actions
- Update to a fixed version (8.2.35 for the 8.2 series, 8.3.36 for 8.3, 8.4.27 for 8.4, 8.5.12 for 8.5)
- If updating is difficult, check the support status of your version (the 8.1 series and earlier are end-of-life (EOL) and will not receive fixes)
- As an interim measure, consider measures such as access restrictions
- Consider your options, including migration or, if necessary, taking the service offline
Update history of the original
- October 27, 2026：A note was added that both CVEs were added to CISA's KEV catalog on October 26, 2026 (US time). IPA states that it has not confirmed any attack victims in Japan.
- November 2, 2026：A note was added that PHP is also used in the web interfaces of VPN and security appliances, so users should also watch product vendors' advisories.