PHP's critical security release: what Upsun is doing

Update: Follow this incident on the Upsun status page.

PHP is releasing fixes for two critical vulnerabilities on Wednesday, 21 October 2026 at 14:00 UTC. PHP rates both 9.2 on CVSS v4.0. Technical details, affected versions and fixed versions come out with the release, and PHP says it will ship early if details leak or someone starts exploiting the flaws.

Researchers at Huntress and Sansec have tied the release to CVE-2026-109618 and CVE-2026-109619, and coverage is calling the pair "php2shell." Nobody has reported exploitation yet.

What we have done

Our security team has put some preemptive mitigations in place in front of every PHP application on Upsun Cloud. We are actively working to protect your applications further, whether or not the PHP image has been patched.

You do not need to do anything right now.

What happens next

On top of the edge protection, we will start updating and patching our PHP runtime images, as quickly and reliably as we can, once PHP publishes the release. We will share the full details on the Upsun developer center: which versions are patched, when the patched runtimes reach your projects, and whether you need to take any action. We will keep that post current as the rollout progresses, and link to it from here.

If you run an end-of-life PHP version

PHP only patches supported branches. The upstream fixes cover PHP 8.2 through 8.5. PHP 8.1 and older are end of life, so if they are affected, PHP will not fix them.

The mitigations protect these versions too, but they do not replace a patched runtime. If you are on 8.1 or older, upgrade now to ensure you automatically get the latest secure patches once they’re out. On Upsun it is one line in .upsun/config.yaml:

applications:
  myapp:
    type: "php:8.4"

Push the change to a preview environment, test it against a copy of production data, then merge.

Where to get updates

Rollout status and technical details will be on the developer center. PHP's own notice is on php.net. For questions about a specific project, open a support ticket from the Upsun Console.