(Technical Alert) CVE‑2026‑109618 and CVE‑2026‑109619: "PHP2Shell"

Security vulnerabilities of critical severity in PHP have recently been identified. Specifically, in PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35, these vulnerabilities could allow an unauthenticated attacker to remotely execute code on installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The following two vulnerabilities have been announced:

• CVE-2026-109618 (Critical – Remote code execution via out-of-memory corruption, affecting all PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35) – Disclosed on 21 October 2026
• CVE-2026-109619 (Critical – Remote code execution via stale global state, affecting all PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35) – Disclosed on 21 October 2026 

Please refer to the following resources for additional information regarding these vulnerabilities:

• PHP Security Advisory: Critical remote code execution vulnerabilities (php.net)
• Official NVD entry for CVE-2026-109618
• Official NVD entry for CVE-2026-109619

Hitachi Vantara is currently investigating its product lines to determine if any are affected by these vulnerabilities. If any products or solutions are found to be impacted, they will be indicated in this section, in subsequent updates to this advisory, along with information regarding mitigations or fixed release versions (if such information is available at the time). Likewise, any products or solutions that have been confirmed not to be affected by the given vulnerability will be listed in the section below.

NOTE: Cited product documentation, including product-specific Alerts and Technical Bulletins, are available to Hitachi Vantara customers logged into Support Connect.

Please continue to check this Security Advisory, as new information will be added as it becomes available.

For independently managed PHP environments, update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install the applicable vendor-provided package containing the fixes. Only an update containing the security fixes provides complete remediation. 

If any of the information presented above remains unclear, please contact the Hitachi Vantara Global Support Center, or your Vantara-authorized service and support provider.

The information contained herein is for informational purposes only. It is not intended as a guaranty or warranty about Hitachi Vantara's products, including any guaranty or warranty that any product cannot be exploited by third parties. All product warranties and obligations to a customer must be specified in a mutually acceptable and executed contract between the parties.