P019C

Php2Shell (CVE-2026-109618/CVE-2026-109619)

Description

CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities in PHP itself, known together as Php2Shell. They let an attacker run code on your server with a crafted request, without logging in. They affect every PHP version from 5.4 on, so Magento, Shopware, WordPress, and any other PHP site are exposed. Attacks were already being reported on the day the fix was released. Sansec has a write-up with more details.

The PHP project fixed both in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, released on October 21, 2026. This patch upgrades the PHP version your deployment uses to its fixed release. Your deployment stays on the same PHP version, only its patch level changes, for example from 8.3.35 to 8.3.36.

Before the fix was out, we applied an emergency hotfix to AutoPilot deployments that turns off PHP's session upload progress feature (session.upload_progress.enabled = Off), following Sansec's temporary mitigation. That reduces exposure, but it doesn't fully close the vulnerability, so upgrading PHP is still the only complete fix. The hotfix setting stays in place after this patch.

Warning

PHP 8.1 and older no longer get fixes from the PHP project, so this patch can't be applied to deployments running PHP 7.4 or 8.1. If your deployment runs one of those versions, please reach out to support@jetrails.com and we'll work with you on moving to a supported version.

Impact

On a single node deployment, PHP-FPM restarts once to load the fixed version, which interrupts requests for a few seconds. On a cluster, PHP-FPM restarts on the web leader, a backup of the web leader is taken, and the rest of your web nodes are replaced with it. There will be some downtime while the new web nodes roll out.

Changes

Upgrades the PHP version your deployment uses to its fixed release on the jump node and the web leader.
Keeps your PHP settings as they are.
Restarts PHP-FPM on the web leader to load the fixed version.
On clusters, backs up the web leader and replaces the rest of the web nodes with it.

If You Accept

Your sites run on a PHP release that fixes CVE-2026-109618 and CVE-2026-109619, which closes the remote code execution path. It's a patch release of the PHP version you already use, so your code and extensions don't need any changes.

If You Reject

Your deployment stays on a PHP release that can be exploited without logging in. An attacker who exploits it can run code on your server, which puts your site, your data, and your customers' data at risk.