# PHP CVE-2026-109618 & CVE-2026-109619

**URL:** https://forums.vitalpbx.org/t/php-cve-2026-109618-cve-2026-109619/6481
**Category:** Reporting an Issue
**Created:** [October 21, 2026, 7:07pm UTC](https://forums.vitalpbx.org/t/php-cve-2026-109618-cve-2026-109619/6481 "2026-10-21T19:07:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mo10](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/m/58f4c7/32.png) [@mo10](https://forums.vitalpbx.org/u/mo10)
#### Post date: [October 21, 2026, 7:07pm UTC](https://forums.vitalpbx.org/t/php-cve-2026-109618-cve-2026-109619/6481/1 "2026-10-21T19:07:26Z")

</div>

Hi,

any news and suggestions on this topic?  
PHP2Shell CVE-2026-109618 & CVE-2026-109619

> **[PHP Remote Code Execution FAQ: CVE-2026-109618 | watchTowr](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/)**
>
> CVE-2026-109618 FAQ: affected PHP versions, fixes and more - updated as details emerge.

Thanks!

---

<div class="post-metadata">

### Author: ![maynor](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/m/3e96dc/32.png) [@maynor](https://forums.vitalpbx.org/u/maynor)
#### Post date: [October 21, 2026, 7:07pm UTC](https://forums.vitalpbx.org/t/php-cve-2026-109618-cve-2026-109619/6481/2 "2026-10-21T19:07:46Z")

</div>

Hello,

The update is now available. You can run the following commands to upgrade PHP to the latest version:

`sudo apt update`

`dpkg -l | awk '$1 == "ii" && $2 ~ /^php8[.]2/ {print $2}' | xargs -r sudo apt install -y --only-upgrade --no-remove`

Once the update is complete, verify the installed PHP version:

`php -v`

Please let me know if the update was successful or if you encounter any issues.,

Best regards,

---

<div class="post-metadata">

### Author: ![miguel](https://forums.vitalpbx.org/user_avatar/forums.vitalpbx.org/miguel/32/415_2.png) [@miguel](https://forums.vitalpbx.org/u/miguel)
#### Post date: [October 21, 2026, 7:13pm UTC](https://forums.vitalpbx.org/t/php-cve-2026-109618-cve-2026-109619/6481/3 "2026-10-21T19:13:35Z")

</div>

Here are all the instructions:

> [@Critical Security Update: PHP 8.2.35 Now Available for Debian 12](https://forums.vitalpbx.org/t/critical-security-update-php-8-2-35-now-available-for-debian-12/6482):
>
> Debian 12 has released the patched PHP version addressing the recently disclosed critical vulnerabilities: CVE-2026-109618 CVE-2026-109619 These vulnerabilities affect PHP 8.2 and may allow unauthenticated remote code execution under certain conditions. The patched version is: PHP 8.2.35 For additional information about these vulnerabilities, please refer to the CERT-EU security advisory: Update Instructions Run the following commands to update the PHP 8.2 packages currently installed o…