Update Regarding The Recent PHP Vulnerabilities Announcement

Please be advised that as at 22/10/26, Kaon Security has addressed the patching requirements associated with the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.

We have applied updates to PHP to fix these vulnerabilities. Prior to applying these updates, we had not observed any exploitation of these vulnerabilities.

For further information, read the Australian Cyber Security Centre alert: Critical vulnerabilities in PHP

Thank you – Kaon Security Team