XFEDI

Conversation

ActivityPub

Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619.

AlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.

🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

AlmaLinux OSphp2shell (CVE-2026-109618, CVE-2026-109619): Patches in progressTwo critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619. Either one can let an unauthenticated attacker run code on a web server, as the account PHP runs under, by sending it crafted HTTP requests. PHP rates both 9.2 (Critical) on CVSS v4.0. AlmaLinux 8, 9, and 10 all ship affected PHP versions. We are aware of these vulnerabilitie

↩ Reply ♡ 0 · ↻ 0 ↗ Original

Oct 21, 2026 · 16:24 UTC

Replies

AlmaLinux@[email protected]

54m

↳ In reply to a post

Update: Patched PHP packages are now available for testing! After the community has helped verify them, we will release them to the production repositories.

Learn more and help with testing: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

↩ Reply ♡ 0 · ↻ 0 ↗ Original