PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Opslogix is not affected

On 21 October 2026, the PHP project disclosed two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619, together known as "PHP2Shell". Several customers have asked us whether Opslogix is affected. The short answer: no. Opslogix does not use PHP anywhere in our infrastructure, applications or the services we provide to customers.

Below you can read what the vulnerabilities are, what to do if you run PHP yourself, and our full assessment.

What is PHP2Shell?

Both vulnerabilities are memory-safety bugs in the PHP engine. They let an unauthenticated attacker run code on a web server with a single request, before any application code runs. Both have a CVSS v4.0 score of 9.2.

• CVE-2026-109618: when PHP runs out of memory while it is setting up a request, partly initialized data can be treated as valid during cleanup. This corrupts memory.
• CVE-2026-109619: internal state that belongs to one request can survive after its memory is freed. A later request handled by the same worker can then use that stale state.

Because the bugs are in PHP itself, a website is exposed even when its own code is secure. This includes popular content management systems and web shops. Every PHP setup that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups with mod_php are at the highest risk.

A working exploit has been demonstrated. Amazon Threat Intelligence also reported an exploitation attempt on 17 October 2026, four days before the vulnerabilities were made public.

What should you do if you run PHP?

• Update PHP. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions received the patches before the public release, so check your distribution for updated packages.
• Older versions. PHP 8.1 and earlier are no longer supported. The PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1, and some distributions and long-term support vendors offer their own fixes. The better long-term answer is to move to a supported version.
• If you can't patch right away. Follow the interim measures in the official PHP advisories, and restart all PHP workers after changing the configuration. The UK National Cyber Security Centre advises taking systems that cannot be fixed offline. Web application firewall rules can help as a stopgap, but they don't replace the update.

The official advisories are on GitHub: CVE-2026-109618 and CVE-2026-109619.

Is Opslogix affected?

No. We assessed our technology stack and confirmed that Opslogix does not use any PHP technologies, frameworks or components in our infrastructure, our applications or the services we provide to customers. Our SCOM management packs and their components do not include or depend on PHP.

You don't need to take any action for your Opslogix products. We continue to monitor security advisories as part of our security management process, and we will update this post if anything changes.

Do you have questions about this or another vulnerability? Contact our support team.

Sources

• PHP security advisory for CVE-2026-109618
• PHP security advisory for CVE-2026-109619
• UK NCSC: Critical security issue affecting PHP
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched
• Unit 42 threat brief: CVE-2026-109618 and CVE-2026-109619