PHP2SHELL Vulnerability Analysis

Last Updated: October 23, 2026

Description

Western Digital is aware of two critical vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), impacting PHP versions 5.4 through 8.5 that were disclosed publicly via the project’s GitHub security advisories on October 21, 2026. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on an affected host.

The PHP maintainers have released fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Source code patches are available for versions 7.4, 8.0, and 8.1, which are end of life and will not receive official binary releases. According to the PHP maintainers, no complete mitigation exists and updating is the only safe option.

We are actively assessing our products and services for potential impact of these vulnerabilities. We will periodically post updates to this bulletin as we investigate.