Two critical security vulnerabilities have been discovered in PHP, a widely used programming language that powers websites and web applications. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, could allow attackers to remotely execute malicious code on affected systems without authentication.

Both vulnerabilities have received a CVSS v4.0 severity score of 9.2 out of 10, making them critical security issues.

On October 21, the PHP development team released emergency security updates addressing both vulnerabilities. DigiCert has assessed the potential impact on our products and services, and we are sharing the steps taken to protect affected infrastructure.

Learn more about PHP2Shell.

What is DigiCert doing to protect its systems?

DigiCert has applied the relevant security patches from the PHP development team. Our Web Application Firewall (WAF) blocks attempted exploitation of these vulnerabilities, providing protection beyond the relevant security patches.

Affected DigiCert products and services (that use PHP):

• CertCentral [ Patches applied and completed ]

Confirmed unaffected products and services (that do not use PHP):

• Trust Lifecycle Manager
• Document Trust Manager
• Content Trust Manager
• Software Trust Manager
• Device Trust Manager
• AI Trust Manager
• UltraDNS
• Quantum Central
• Valimail + DigiCert

What is PHP2Shell?

PHP2Shell refers to two remote code execution (RCE) vulnerabilities in PHP itself, rather than in a specific application, content management system, or plugin.

The vulnerabilities involve flaws in how PHP handles internal request data and memory. Under certain conditions, an attacker could exploit these flaws to execute unauthorized commands on a vulnerable server.

Of particular concern is that some attack paths can be triggered before application code runs. This means application-level authentication and input validation may not prevent exploitation.

The vulnerabilities are:

• CVE-2026-109618: A memory-handling vulnerability involving partially initialized request data during out-of-memory conditions.
• CVE-2026-109619: A vulnerability involving internal request data that remains accessible after its memory has been freed.

Because PHP is widely used to support websites and web applications, these vulnerabilities warrant prompt attention from organizations running affected versions.Give the decision and the submission an owner

Which PHP versions are affected?

All versions of PHP are confirmed to be vulnerable except for the recently released patched versions below.

The PHP development team has released fixes for the following supported branches:

What do you need to do?

We do not expect this vulnerability to impact our customers’ experience with DigiCert. No action is required, and all certificate operations are secure and fully operational.

Organizations that independently operate PHP-based websites or applications should review their environments and apply the appropriate PHP security updates, regardless of whether they use DigiCert products.

For systems running affected PHP versions, the PHP security team recommends upgrading to a patched release and restarting the relevant services to ensure the updated software is in use.

Staying informed

DigiCert continues to monitor security developments that could affect our products, services, and customers.

For the latest technical details and available patches, see the official PHP security advisory.