PHP advisories

PHP interpreter and PHP application advisories: WordPress, Drupal, Joomla and anything running on PHP-FPM or mod_php.

CriticalVulnerabilityPatch available

PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch the PHP engine, not just your app

Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

21 Oct 2026CVE-2026-109618, CVE-2026-109619PHP