.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Informational
Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
CVE(S)
CVE-2026-109618
CVE-2026-109619
PRODUCT(S)
N/A
Updated
2026 Oct 21
Article Version
1
First Published
2026 Oct 21
Publication ID
sophos-sa-20261021-php2shell
Workaround
No
Overview
Sophos is aware of the recently disclosed critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619 and also referred to as “PHP2Shell”.
We are actively investigating whether any Sophos products or services are affected. This advisory will be updated with our findings, including any affected products and remediation guidance, as our investigation progresses.
Related information:
Sophos Responsible Disclosure Policy
To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.