PHP2Shell - remote code execution in the PHP runtime

CAST position on PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and the PHP runtime extensions that fix it

Overview

PHP2Shell is the name given to two critical vulnerabilities in the PHP runtime engine, CVE-2026-109618 external link and CVE-2026-109619 external link. This bulletin lists which CAST products are affected and what you need to do.

Severity Status Published Last updated
Critical Fix available 2026-10-21 2026-10-21

What is PHP2Shell?

Under some configurations, both flaws let an unauthenticated attacker run code remotely on a server that runs PHP. Because the flaws are in PHP itself, any application running on an unpatched PHP version may be exposed, even if the application code is safe. There are early reports of exploitation attempts.

PHP fixed both vulnerabilities on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Affected CAST products

Product Status Fixed in
CAST Imaging container images Not affected - no PHP runtime included -
PHP 8.4 Runtime extension (com.castsoftware.php.runtime84) Affected up to 1.0.2-funcrel (PHP 8.4.21) 1.0.3-funcrel external link (PHP 8.4.27)
PHP 8.2 Runtime extension (com.castsoftware.php.runtime82) Affected up to 1.1.3-funcrel (PHP 8.2.31) 1.1.4-funcrel external link (PHP 8.2.35)

The PHP runtime extensions are installed in CAST Imaging when you analyze PHP applications: the PHP Analyzer extension uses one of them to process PHP source code. The PHP runtime only runs during analysis and does not serve web requests.

What do I need to do?

If you do not analyze PHP applications with CAST Imaging, no action is required.

If you do:

  1. If you use Extend Local Server in offline mode, add the fixed releases to it. In online mode, Extend Local Server downloads them from CAST Extend.
  2. Make sure your applications use the fixed releases: com.castsoftware.php.runtime84 1.0.3-funcrel or later, and com.castsoftware.php.runtime82 1.1.4-funcrel or later. With Auto Update enabled (the default setting), extensions are updated only at the next analysis of new source code. To update them without delivering new source code, run an analysis with the Update extensions option of the Run Analysis section. With Auto Update disabled, select the fixed release for each application.
  3. Check that each application now uses a fixed release of the PHP runtime extension.

Your Solution Architect or CAST Professional Services can help you with the update.