Update Regarding The Recent PHP Vulnerabilities Announcement

Please be advised that as at 22/10/26, Protocol Policy Systems has addressed the patching requirements associated with the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests.

We have applied updates to PHP to fix these vulnerabilities. Prior to applying these updates, we had not observed any exploitation of these vulnerabilities.

For further information, read the National Cyber Security Centre alert: Critical Security Issue Affecting PHP

Thank you - Protocol Policy Systems Team