Resources
Start with the PHP advisory, then the distribution tracker for the package you run. This site records what those sources said on 22 October 2026.
Vulnerability12 articlesPHP versions16 articlesWeb servers11 articlesOperating systems17 articlesPlatforms15 articlesCloud12 articlesGuides16 articlesConsulting10 articles
Primary sources
- PHP security advisory, 21 October 2026
- GHSA-w8hw-w9fx-j79w, CVE-2026-109618
- GHSA-6wmf-4rv5-p3rp, CVE-2026-109619
- PHP supported versions
- PHP unsupported branches
- Ubuntu php2shell fixes
- Debian tracker, CVE-2026-109618
- Debian tracker, CVE-2026-109619
- AlmaLinux patched packages
- Red Hat CVE-2026-109618
- CISA alert, 21 October 2026