Update: Patched PHP packages are now available for testing! After the community has helped verify them, we will release them to the production repositories.
Learn more and help with testing: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
AlmaLinux OSphp2shell (CVE-2026-109618, CVE-2026-109619): Patches in progressTwo critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619. Either one can let an unauthenticated attacker run code on a web server, as the account PHP runs under, by sending it crafted HTTP requests. PHP rates both 9.2 (Critical) on CVSS v4.0. AlmaLinux 8, 9, and 10 all ship affected PHP versions.
We are aware of these vulnerabilitie