| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical (CVSS 9.2), remote code execution |
| Patch | PHP: available since 21 Oct (8.2.35, 8.3.36, 8.4.27, 8.5.12). PAN-OS: not yet available. |
| Attacks | Unpatched systems are targeted very quickly |
| ON2IT | Own platforms not vulnerable |
Two very critical vulnerabilities have been found in PHP itself: CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell. Both are rated CVSS v4.0 9.2 and allow remote code execution on vulnerable servers. Details leaked before a fix was available. The PHP security team released patched versions on 21 October 2026.
Read the full story of that day: what kept our customers safe before the patch.
Update 22 October, 11:30 UTC: Palo Alto Networks PAN-OS
Palo Alto Networks confirms that PAN-OS and Panorama are affected, through the management interface. A PAN-OS fix is not yet available. Until then, restrict access to the management interface to trusted internal IP addresses, as Palo Alto Networks recommends. See the Palo Alto Networks advisory for details and fixed versions.
ON2IT managed customers are being informed directly.
Update 22 October, 09:30 UTC: patch available, attacks come fast
A patch is now available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Install it now. It is not yet fully clear, however, whether this patch resolves every problem. Analysis of the vulnerabilities is still ongoing, and older PHP versions (8.1 and earlier) have no official fixed release.
It is now known that systems that are not patched are targeted very quickly. Exploit attempts are being observed. Treat every unpatched, internet-facing PHP system as a likely target.
Who is at risk
Any system running PHP, and PHP runs a large part of the internet. Not just websites and web applications, but also hosting platforms, appliances and third-party software with PHP built in, often without it being visible. Versions before the patched releases are affected. PHP 7.4 to 8.1 have no official fixed release, only limited source fixes from the PHP security team. End-of-life versions (7.3 and older) will not receive a fix.
What you should do
- Identify every system that runs PHP, including the less obvious ones.
- Patch now, internet-facing systems first. Do not wait.
- Take systems that cannot be patched offline, or restrict access to them.
- Do not treat the patch as the final word. Keep monitoring PHP systems for suspicious activity and follow updates from the PHP security team.
Follow the official guidance of your national cybersecurity authority: CISA in the United States, NCSC in the Netherlands. For affected versions and the fix itself, see php.net.
ON2IT status
- ON2IT's own platforms are not vulnerable. Our websites on2it.net and on2it.nl do not use PHP either.
- As a precaution, we temporarily took a number of systems offline.
- Our customers have been informed. Need help? Call our 24/7 GSOC: Europe +31 (88) 22-66-201, North America +1 214 206-8446.
A PHP patch is available, but it is not yet certain that it resolves every problem. Patch now, and stay alert. A PAN-OS fix is still pending.
We will update this page as new information becomes available. Last updated: 22 October 2026, 11:30 UTC.