Update Regarding The Recent PHP Vulnerabilities Announcement

Please be advised that as at 22/10/26, Kaon Security has addressed the patching requirements associated with the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.

We have applied updates to PHP to fix these vulnerabilities. Prior to applying these updates, we had not observed any exploitation of these vulnerabilities.

For further information, read the New Zealand National Cyber Security Centre alert: CVE-2026-109618 and CVE-2026-109619 affecting PHP

Thank you – Kaon Security Team