Karen IT Security Response Center (KSRC) Advisory

Publication Date: 22 October 2026

Update on PHP2Shell Vulnerabilities
CVE-2026-109618 & CVE-2026-109619

Summary

Following our previous urgent advisory, the PHP project officially released security updates on 21 October 2026 addressing the critical PHP2Shell vulnerabilities.

The fixed versions are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

KSRC strongly urges all organizations to install these updates immediately and restart all PHP workers (PHP-FPM, mod_php, etc.). Updating remains the only complete and reliable remediation for these critical unauthenticated Remote Code Execution vulnerabilities.

Current Recommendation on Version Selection

While the official patches have been released, community reports and independent researcher claims have emerged regarding potential residual issues specifically on the PHP 8.5.12 branch. Although these reports have not yet been officially confirmed by the PHP security team, KSRC is adopting a cautious and conservative approach.

Our recommendations at this time:

1. Temporarily avoid PHP 8.5
   Until the reported issues on 8.5.12 are fully investigated and clarified, we recommend not deploying or remaining on PHP 8.5 in production environments.
2. Do not use any PHP version below 8.2
   Versions older than 8.2 (including 8.1 and earlier) are end-of-life. They either lack official patches or rely only on limited source backports and should no longer be used.
3. Migrate all systems to supported PHP versions above 8.2
   Organizations should ensure their applications and infrastructure are fully compatible with modern PHP branches and actively transition to supported releases.
4. Preferred version: PHP 8.4
   At present, PHP 8.4 (specifically the fixed release 8.4.27 or later) is our recommended choice for production use. It offers a good balance of security, stability, and longer-term support.

Important Reminders

• After upgrading PHP, all PHP processes must be restarted for the fix to take effect.
• There are no complete configuration-based workarounds. Updating is the only reliable solution.
• Continue monitoring official PHP channels and KSRC updates for any further developments, especially regarding the 8.5 branch.

Karen IT
We make the Internet harder to abuse.