Skip to main content
Sign in

TuxCare Knowledge Base

  1. TuxCare
  2. KernelCare
  3. Articles

Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619

Ramiro Muñoz
  • Updated

Issue

PHP2Shell is a pair of critical memory-safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting the PHP core across versions 5.4 through 8.5. They were publicly disclosed in October 2026 and allow unauthenticated attackers to achieve Remote Code Execution (RCE) on affected web servers.

Customers ask whether patched PHP packages are available for their PHP version and OS, and whether their current subscription covers them.

Environment

  • PHP 5.2–5.6, 7.0–7.4, 8.0–8.5
  • alt-php (TuxCare ELS for PHP)
  • ELS for OS: CentOS 6/7/8, RHEL 7, Ubuntu 16.04/18.04/20.04, Debian 10/11, Amazon Linux 2
  • Debian 12 and Debian 13
  • cPanel/WHM, Plesk

Solution

Backported fixes have been delivered to every alt-php branch: 5.2–5.6, 7.0–7.4 and 8.0–8.5.

Upstream PHP fixed only 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For older branches, the fix comes from TuxCare.

PHP 8.1 and older got no release from the PHP project. PHP's security team published minimal source backports for 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on December 31, 2026.

A fixed build keeps the old PHP version and gets a new release number. Example: alt-php74 stays at 7.4.33 and changes from release -79 to -81 on EL7.

To check one branch and OS, use the CVE tracker: CVE-2026-109618 and CVE-2026-109619.

On ELS for OS platforms, the native OS PHP packages also got the fix. Examples: Ubuntu 16.04/18.04/20.04, Debian 10/11, CentOS 6/7/8, RHEL 7, Amazon Linux 2.

For Debian, fixed alt-php packages are in the stable repositories:

  • Debian 12: alt-php 5.6, 7.4, 8.0, 8.1, 8.3, 8.4

  • Debian 13: alt-php 5.2–5.6, 7.4, 8.0, 8.1, 8.3, 8.4

    Security advisory metadata (OVAL/VEX/UpdateInfo and errata) is published after the PHP packages are released for all distributions. Update without waiting for it.

Which subscription covers which PHP:

  1. The OS-level ELS subscription (for example, TuxCare ELS for CentOS 7) covers the PHP package that ships with the OS. On CentOS 7 that is PHP 5.4.
  2. PHP from third-party repositories (for example, Remi) is not covered. If the repository publishes no update, that build stays vulnerable.

  3. The alt-php builds (for example, alt-php83 on CentOS 7) come from the separate ELS for PHP service, which requires its own license. Once it is set up, install the alt-php build for the needed version and switch the sites to it.

    Installing ELS for PHP does not require downtime and does not require changes to application source code.

For pricing and purchase, customers contact sales@tuxcare.com.

Useful Links

Comments

0 comments

Article is closed for comments.