Customer Statement: PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Last updated: October 21, 2026
Summary
On October 21, 2026, researchers publicly disclosed “PHP2Shell,” a set of vulnerabilities in the PHP language engine that can allow remote code execution and memory disclosure on affected systems. These issues affect PHP itself and the web applications that run on it.
Impact on Posit Hosted and on-premises products
Posit products do not include or depend on PHP, and none of our products ship, bundle, or require a PHP runtime. CVE-2026-109618 and CVE-2026-109619 therefore do not affect Posit products, and you do not need to take any action for these vulnerabilities.
Recommendations
If you run PHP applications elsewhere in your environment, including on the same hosts or infrastructure as Posit products, apply the PHP security updates released on October 21, 2026. Patching is the only complete remediation. Details are in the PHP release announcement.