Critical PHP vulnerabilities could allow unauthenticated attackers to execute code remotely on affected systems. Businesses should assess their exposure and prioritise remediation.
Form IT Solutions Security Advisory | 27 October 2026
Two critical vulnerabilities in the PHP runtime, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, could allow unauthenticated attackers to execute code remotely on affected systems.
PHP is widely used to power websites, web applications and business services. As these vulnerabilities reportedly affect the PHP runtime itself, organisations should treat remediation as an immediate priority.
Form IT Solutions is assessing the potential impact across its products and services and taking appropriate action. We will update this advisory as verified information becomes available.
Remote code execution can allow an attacker to run malicious commands on a vulnerable system. The potential impact depends on the system, its configuration and the permissions available to the affected service.
Potential access to vulnerable systems without valid authentication.
Potential compromise of applications, data and service availability.
Take the following steps to identify exposure, reduce risk and remediate affected systems.
Identify affected PHP versions and apply the appropriate security updates immediately, prioritising systems accessible from the internet. Verify that updates have been applied successfully.
Check web servers, hosting control panels, third-party applications, network appliances, bundled software and other vendor-managed products.
Address externally accessible systems first, then work through internal applications and other affected infrastructure. Track remediation to completion.
Investigate unexpected shells, interpreters, child processes, download utilities and suspicious outbound connections associated with PHP, php-fpm or Apache.
If immediate remediation is not possible, apply additional safeguards to reduce the potential for exploitation:
These safeguards do not replace patching. WAF protections can reduce exposure but cannot guarantee protection. Applying the appropriate security fixes remains the priority.
Form IT Solutions is assessing the potential impact of PHP2Shell across its products and services and taking appropriate action.
We will continue to review verified security information and update this advisory as further details become available.
Consult official security notices and your software vendors for verified information about affected versions and available fixes.
Check this advisory regularly for updates from Form IT Solutions.
If your organisation needs assistance identifying potentially affected systems, coordinating remediation or reviewing its cyber security measures, contact Form IT Solutions.
Review your PHP installations, follow vendor security guidance and prioritise remediation to help protect your organisation.
Get an estimate, general enquiries or request a call.
