Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619.
AlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.
🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/
AlmaLinux
npub1ax…3lujq
2026-10-21 16:24:25 UTC
Author Public Key
npub1ax5chf02hudke2wumsdjujenxtpsxjg94qgqtk5zldezkw4xpt0sx3lujqSeen on
wss://relay.momostr.pinkPublished at
2026-10-21 16:24:25 UTCEvent JSON
{
"id": "fa6a28287dd217a7d1f570df2565480fe8c899dc4bae4969e29fbb959d9862f1",
"pubkey": "e9a98ba5eabf1b6ca9dcdc1b2e4b3332c3034905a81005da82fb722b3aa60adf",
"created_at": 1792599865,
"kind": 1,
"tags": [
[
"proxy",
"https://fosstodon.org/@almalinux/117479824791319842",
"web"
],
[
"proxy",
"https://fosstodon.org/users/almalinux/statuses/117479824791319842",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://fosstodon.org/users/almalinux/statuses/117479824791319842",
"pink.momostr"
],
[
"-"
]
],
"content": "Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619. \n\nAlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.\n\n🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/",
"sig": "b9756340685997fa4a93c374309974ceeaba3838934092466680574cfbe6317af45eece979ba0e5b6adbe68dfe7d34de00b8e003acd2d786b6a13d75c65271ad"
}