PHP2Shell
PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution on affected PHP installations serving web requests.
Impact on Sonatype Products
Sonatype has confirmed that its products are not affected by these vulnerabilities. You do not need to update or reconfigure a Sonatype product to address PHP2Shell.
This confirmation applies to Sonatype products. It does not cover PHP applications, services, containers, or third-party appliances that your organization runs separately.
What You Need to Do
You do not need to take any action related to Sonatype products to address these vulnerabilities. However, if your organization operates PHP systems, update them to a fixed PHP release or apply your operating system or PHP vendor’s patched package. Check internet-facing systems first, and include containers, appliances, and other products that bundle PHP.
PHP Branch | Fixed Upstream Release |
|---|---|
PHP 8.5 | 8.5.12 |
PHP 8.4 | 8.4.27 |
PHP 8.3 | 8.3.36 |
PHP 8.2 | 8.2.35 |
Linux distributions and long-term support vendors may provide backported fixes, so check your vendor’s advisory if its package version differs from the upstream versions listed above. For PHP 8.1 and older, contact your vendor about a backported fix or upgrade to a supported PHP version.
If you cannot update immediately, consult the PHP security advisory for measures that can reduce exposure to specific attack paths. These measures do not make an installation safe and are not a substitute for updating.
Related information: PHP security advisory · PHP downloads · Sonatype Guide Security Events · Sonatype Trust Center Updates
The PHP project confirms the fixed releases and says temporary measures do not make affected installations safe; upgrading is the complete fix.