Operational information: 28 October 2026 16:46 CET
Software list last status update: 4 November 2026 08:15 CET
This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619.
PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.
This repository tracks 948 products, including 215 vulnerable and 185 fixed.
On 21 October 2026, PHP published fixed releases for CVE-2026-109618 and CVE-2026-109619: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP states that both vulnerabilities can allow unauthenticated remote code execution and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs.
PHP describes CVE-2026-109618 as remote code execution via out-of-memory corruption during request cleanup, and CVE-2026-109619 as remote code execution via stale request-owned global state reused by a later request on the same worker. PHP 8.1 and older are no longer supported by the PHP project; distributions and LTS vendors may provide backported packages, and PHP has published minimal source backports for PHP 7.4, 8.0 and 8.1.
On 23 October 2026, PHP published an informational advisory suggesting session.upload_progress.enabled=0 until the next regular bugfix release to fully protect from an unlikely RCE vector (CVE-2026-115560). PHP will publish a full advisory with the next release; this repository does not track CVE-2026-115560 separately in the software list.
The impact is not limited to websites: PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly.
- Identify PHP-based applications and their runtime versions, with priority on internet-facing systems and web-serving SAPIs.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor-provided backported packages.
- After updating, keep
session.upload_progress.enabled=0until the next regular PHP bugfix release (PHP informational advisory of 23 October 2026, CVE-2026-115560), unless your application needs the feature and never changessession.serialize_handlerat runtime. - Check third-party images, appliances and embedded runtimes separately; for products that bundle PHP, apply vendor updates as soon as they become available.
- If immediate patching is not possible, follow PHP's temporary mitigations, including disabling
session.upload_progress, restarting workers, and reviewing the officialmemory_limit,post_max_sizeand PHP 8.5fatal_error_backtracesguidance. PHP states that these measures are not complete fixes. - Monitor vendor advisories, internet-facing logs, and public exploit activity.
For additional information see:
- CERT-EU Security Advisory 2026-018
- PHP security advisory: Critical remote code execution vulnerabilities, update now
- PHP informational advisory: Session upload progress (23 October 2026)
- List of advisories from other EU national CSIRT's
- PHP2shell observations in the wild (TU Delft)
| Directory | Purpose |
|---|---|
| detection_mitigation | Contains detection and mitigation material for the vulnerabilities. |
| software | Contains inventory lists of software products with a PHP dependency potentially affected by the vulnerabilities. |
| tools | Contains tools for using/generating files within this repo |
| Community contributions | Community tools, tips, guides, and reference resources. |
The repository is being updated as the situation develops. Check back for updates.
Statistics as of 2026-11-04 (UTC), from the current SPDX inventory.
| Products tracked | Fixed | Vulnerable | Under investigation | Runtime-dependent | Not affected | Unassessed / unknown |
|---|---|---|---|---|---|---|
| 948 | 185 | 215 | 93 | 240 | 214 | 1 |
Counts by update day and per-CVE statistics (JSON) | Software list
| Date and time | Supplier | Product | Version (see Status) | Status CVE-2026-109618 / CVE-2026-109619 | Links |
|---|---|---|---|---|---|
| 2026-11-04 08:15:46 +0100 | Centreon | Centreon Cloud hosted service (patched PHP rollout) | Cloud rollout confirmed 2026-10-22; service build unspecified | Fix | source |
| 2026-11-04 08:15:46 +0100 | EGroupware GmbH / EGroupware project | EGroupware Cloud hosted service (patched PHP rollout) | Hosted service rollout completed 2026-10-21; vendor confirmation updated 2026-10-27 | Fix | source |
| 2026-11-04 08:15:46 +0100 | EGroupware GmbH / EGroupware project | EGroupware official Docker images with patched PHP | 26.10.20261021 and 23.1.20261021; PHP 8.5.12 | Fix | source 1 source 2 source 3 |
| 2026-11-04 08:15:46 +0100 | Grokability / Snipe-IT project | Snipe-IT hosted service (patched PHP rollout) | Vendor-confirmed patched hosted fleet, October 2026; service build unspecified | Fix | source |
| 2026-11-04 08:15:46 +0100 | Grokability / Snipe-IT project | Snipe-IT official Ubuntu and Alpine Docker images with patched PHP | snipe/snipe-it:v8.8.2 (Ubuntu); snipe/snipe-it:v8.8.3-alpine | Fix | source 1 source 2 source 3 source 4 |
See the full software status update history.
If you have any additional information to share relevant to these PHP vulnerabilities, feel free to open a Pull request. New to this? Read how to contribute in GitHub's documentation.
For updates to the software list: our strong preference is to receive edits in the SPDX source files in software/spdx/. The Markdown list pages are generated automatically from those files. In case this proves too difficult: don't worry. We'll attempt to backport edits in the .md files to the SPDX source files, but without any guarantees.
For a list of other contributions made by our community, see Community contributions.