| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical (CVSS 9.2), remote code execution |
| Patch | Expected 21 Oct, 16:00 Dutch time (14:00 UTC) |
| ON2IT | Not vulnerable |
Two very critical vulnerabilities have been found in PHP itself: CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell. Both are rated CVSS v4.0 9.2 and allow remote code execution on vulnerable servers. Details leaked before a fix was available. The PHP security team has announced a security release for 21 October 2026 at 14:00 UTC.
Who is at risk
Any system running PHP, and PHP runs a large part of the internet. Not just websites and web applications, but also hosting platforms, appliances and third-party software with PHP built in, often without it being visible. Affected versions are not yet confirmed. End-of-life PHP versions may not receive a fix at all.
What you should do
- Identify every system that runs PHP, including the less obvious ones.
- Patch as soon as the fixed versions are out, internet-facing systems first.
- Take systems that cannot be patched offline, or restrict access to them.
Follow the official guidance of your national cybersecurity authority: CISA in the United States, NCSC in the Netherlands. For affected versions and the fix itself, see php.net.
ON2IT status
- Our products are not vulnerable. Our websites on2it.net and on2it.nl do not use PHP either.
- As a precaution, we have temporarily taken a number of systems offline until a patch is available.
- Our customers have been informed. Need help? Call our 24/7 GSOC: Europe +31 (88) 22-66-201, North America +1 214 206-8446.
A patch is expected on 21 October 2026 at 16:00 Dutch time (14:00 UTC, 10:00 AM ET).
We will update this page as new information becomes available. Last updated: 21 October 2026.