Patch internet-facing PHP now

Loading News Room

October 22, 2026

Trustity is tracking two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Organizations that serve PHP should update today. Trustity Control Platform itself is not a PHP application.

Ashkelon, Israel - October 22, 2026 - Trustity is advising customers and partners to update PHP immediately. On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Advisories from CISA, ENISA, CERT-EU, and the PHP Foundation describe them as unauthenticated remote code execution on PHP installations that serve web requests. The issues are being discussed publicly as php2shell. The Trustity Cloud Portal, the TAO agent, and trustity.co are not PHP applications. These vulnerabilities are not a defect in those products. Many organizations still run PHP inside websites, appliances, and commercial software that embeds PHP. Those systems need attention whether or not the product is labeled as PHP. What to do Inventory every system that serves PHP, including software that bundles it. Update supported branches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Restart the PHP workers, and redeploy containers built on an older image. PHP 8.1 and older are outside upstream support. Move them to a supported branch, or take the internet-facing service offline until that is done. Prioritize systems that accept requests from the internet. Watch for PHP worker processes launching shells or downloading tools. A web application firewall can reduce exposure while the update is applied. It does not replace the patched release. Official sources CISA: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching PHP Foundation: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ PHP release archive: https://www.php.net/archive/2026.php ENISA joint statement: https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities NCSC-NL list of products that bundle PHP: https://github.com/NCSC-NL/php2shell Our security research and threat intelligence teams continue to track these PHP vulnerabilities worldwide and closely monitor new reports as they emerge. We're here to support any customer with concerns about these vulnerabilities, including guidance on mitigation. Please contact our support team for assistance. Questions about a Trustity deployment can go to security@trustity.co.