PHP vulnerability
remediation.
CVE-2026-109618
& CVE-2026-109619
Telnetworks can assist Australian businesses, corporate IT teams and government organisations responding to PHP2Shell.
Assess affected systems, coordinate security updates and verify patch status. Plan recovery or server migration where required.
- PHP vulnerability assessment
- Patching & verification
- Recovery & migration
Identify your PHP installations, apply the appropriate vendor updates and monitor related services. Confirm the fixes are in use across your environment.
Understand the two
PHP vulnerabilities.
These critical vulnerabilities can allow unauthenticated remote code execution. Confirm the applicable fixes for every PHP installation serving web requests.
CVE-2026-109618
A flaw in PHP’s handling of out-of-memory conditions can corrupt internal request data and lead to remote code execution. Assessment establishes which packages need the relevant vendor fix.
CVE-2026-109619
Invalid internal state can remain after memory has been freed and be used by a later PHP request. Remediation includes applying the fixed package and verifying the running services.
Released upstream fixes: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Use the latest applicable maintained release or vendor-patched package. Vendor backports can make package details important; configuration changes alone do not replace the fixes. Official patch guidance ↗
PHP2Shell security update — 25 October 2026
Security updates are available for CVE-2026-109618 and CVE-2026-109619. Organisations should identify their PHP installations, apply the appropriate vendor fixes and verify that the updated packages are running across the affected environment.
PHP published additional guidance on 23 October concerning session upload progress and CVE-2026-115560. This issue depends on an unusual combination of application behaviour and configuration. Review the latest PHP and hosting-provider guidance to determine whether further mitigation is required.
Telnetworks can assist with assessment, patching coordination and verification, with recovery, upgrades or migration considered where required.
What does your organisation
need right now?
Start with your affected services, current patch status and the people responsible for approving and validating changes.
Assess PHP2Shell
exposure
Identify PHP installations, review vendor guidance and establish which packages and services need attention.
Apply & verify
PHP security fixes
Coordinate authorised updates, check application compatibility and verify the corrected packages are in use.
Recover or migrate
affected services
Investigate interrupted applications and assess a supported upgrade or migration where the existing platform needs broader change.
Keep critical services in focus.
Websites · Public-facing services · Online applications
Confirm the fix.
Check the service.
A working website does not confirm that every PHP installation is patched. An interrupted service also needs its cause investigated.
For Plesk, review website PHP handlers and management components separately against the vendor’s advisory.
- Review installed packages and the applicable vendor fixes.
- Coordinate updates with your IT team, provider or developer.
- Validate priority functions and record unresolved work.
Patch, upgrade
or migrate?
The response to these PHP vulnerabilities depends on your applications, available vendor fixes and the support status of your existing platform.
We help explain what needs to change and how the transition can be managed around your services.
01 Security update
A maintained platform has an applicable fix. Apply the vendor update and validate the affected services.
02 PHP & application upgrade
An older application restricts your update options. Review vendor fixes and compatibility, then agree a maintained software path.
03 Server migration
Your operating system or hosting platform cannot be maintained. Assess a supported server, VPS or managed hosting environment.
These are PHP software vulnerabilities. New physical hardware is considered where support, reliability or capacity also justifies a change.
Urgent action.
Clear responsibilities.
Agree the response around your critical services, authorised contacts, application owners and change requirements.
Assess
Identify PHP installations, affected services, vendor fixes and operational impact.
Plan
Agree scope, access, approvals, recovery readiness and the change window.
Check
Review dependencies, testing and how exposure will be managed.
Update
Apply agreed fixes, upgrades or migration and verify the PHP services in use.
Validate
Check priority functions, record patch status and identify outstanding work.
Business, corporate
& government support.
Telnetworks can discuss a scoped PHP remediation response for Australian businesses, corporate IT teams and government organisations, including agencies and councils.
Multiple applications and providers can make urgent changes harder to coordinate. Plan the work around your priority services, authorised contacts and approval requirements.
Authorised access · Change coordination · Documented patch status
Businesses
Get a clear explanation of the issue affecting your website, online store or customer portal, with agreed priorities for patching and service recovery.
Corporate IT teams
Coordinate work across applications, vendors and change owners. The scope can include an affected-system inventory, testing responsibilities and remediation status.
Government agencies
& councils
Discuss public-facing services and internal applications. Access approvals, procurement conditions, security procedures, data handling and change evidence are agreed before work begins.
Ongoing patching, monitoring and infrastructure support.
Assessment, incident response and recovery assistance.
Dedicated servers, VPS and managed hosting options.
Before you
make a change.
Practical answers for business owners, corporate IT teams and government organisations.
Can you assist with both PHP2Shell CVEs?
Telnetworks can discuss assessment, patching, verification, recovery and migration assistance for CVE-2026-109618 and CVE-2026-109619. Scope depends on the installed packages, applications, access and available vendor fixes.
Can government agencies and councils request assistance?
Yes. Government organisations can discuss a scoped PHP remediation engagement. Security procedures, procurement conditions, access approvals, data-handling requirements and change documentation are agreed before work begins. Available delivery arrangements depend on your environment and requirements.
Does updating WordPress fix the underlying PHP vulnerabilities?
Updating WordPress, plugins or themes does not by itself establish that the server’s PHP package is patched. The PHP runtime needs the relevant vendor fixes, and applications should be checked for compatibility.
How can we confirm a PHP update was successful?
Review the installed package and vendor advisory, confirm the running services use the corrected package and validate agreed application functions. A public website check or version banner alone cannot establish the status of every PHP installation.
Do these PHP vulnerabilities require a new server?
Not necessarily. A maintained server may only need an applicable software update and validation. Broader upgrades or migration are considered when software support, application dependencies, hardware condition or capacity justify them.
What if our application needs an older PHP version?
Check whether the provider offers a fix for that exact package. A vendor backport can address these vulnerabilities without restoring upstream lifecycle support. Plan for ongoing maintenance as well as the immediate fix.
Will remediation interrupt our online services?
Service restarts, application compatibility and hosting architecture affect interruption. Testing, maintenance windows, recovery arrangements and expected impact are discussed when the work is scoped.
Can you work with our current IT team and provider?
Yes. Telnetworks can coordinate the agreed server and infrastructure work with your internal team, hosting provider and developer. Responsibilities, access and any application development work are established before changes begin.
What should we include in an enquiry?
Provide your organisation’s name, affected websites or applications, provider if known, current availability and any security notice or update error. Identify priority services and relevant access, procurement or approval requirements.
Need help responding
to PHP2Shell?
Tell us which systems are affected by CVE-2026-109618 or CVE-2026-109619, which services need priority and what approval requirements apply.
Australian businesses, corporate IT teams
& government organisations.
Security information reviewed 22 October 2026.
ASD ACSC alert · Official PHP advisory