PHP2Shell flaws put products running PHP at risk of remote code execution

PHP2Shell has been disclosed with two critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers running PHP. The flaws prompt RCE via OOM corruption and via a stale global state, and PHP has issued fixed builds on 21 October 2026. The Public advisory notes that fixes are included in PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with older PHP versions not receiving official backports; patches are required across affected products that embed or rely on PHP.

The page also records that, at the time of reporting, there had been no confirmed exploitation, and it lists two CVEs with their fixed versions and PatchThis exploit indicators as “Not exploited” (PoC available in some cases).

SecurityOnline[.]info’s list documents a wide range of affected products across multiple vendors and deployment contexts. In appliances and enterprise software, examples include Palo Alto Networks PAN-OS, Cisco Expressway and URWB lines, Citrix NetScaler, F5, Check Point, and Broadcom’s Carbon Black App Control Server. NAS and storage vendors such as QNAP (QTS and related kits) and Synology are noted as affected, with some end-of-life PHP packages also implicated.

Hosted services saw impact in Sophos MyUTM licensing portals. Products with fixes listed include Okta Access Gateway, Broadcom Symantec Endpoint Protection Manager, Tenable Security Center, Checkmk Appliance, Netgate pfSense, OPNsense, Synology PHP updates, Unraid, and several hosting control panels (cPanel/WHM, Plesk, DirectAdmin, HestiaCP, aaPanel), plus cloud and container images.

The article also marks categories still under investigation and those confirmed not affected, and urges patching and mitigations as vendor advisories ship.