--- title: PHP Vulnerability, php2shell (CVE-2026-109618 / CVE-2026-109619) PHP runtime upgrade. description: PHP Vulnerability php2shell (CVE-2026-109618 / CVE-2026-109619) PHP runtime upgrade --- [Skip to content](https://support.block64.com/php-vulnerability-php2shell-cve-2026-109618-cve-2026-109619#main-content) [Customer Portal](https://customerportal.block64.com/tickets-view?hsLang=en) [![Logo - dark](https://support.block64.com/hs-fs/hubfs/Logo%20-%20dark.png?width=350&height=86&name=Logo%20-%20dark.png)](https://support.block64.com/?hsLang=en) - [Home](https://support.block64.com/) - [Insights Portal](https://insights.block64.com/login) - Platform Show submenu for Platform - [Block 64](https://www.block64.com/) - [Why Block 64?](https://www.block64.com/#:~:text=What%20makes%2CBlock%2064%20different) - Solutions Show submenu for Solutions - [Unified Visibility](https://www.block64.com/solutions/unified-visibility) - [Cost Optimization](https://www.block64.com/solutions/cost-optimization) - [Proactive Security](https://www.block64.com/solutions/proactive-security) - [Compliance](https://www.block64.com/solutions/continuous-compliance) - Learn Show submenu for Learn - [Quick Start Guides](https://support.block64.com/getting-started) - [Integrations](https://support.block64.com/documentation#integrations) - [Blog](https://www.block64.com/blog) - Support Show submenu for Support - [Trust Center](https://trust.block64.com/) - [Service Health](https://status.block64.com/) - [Partners](https://www.block64.com/partners) - [Contact Us](https://www.block64.com/contact) - [Pricing](https://www.block64.com/pricing) - [Get Started Free](https://www.block64.com/free-trial) Open main navigation Close main navigation - [Home](https://support.block64.com/) - [Insights Portal](https://insights.block64.com/login) - Platform Show submenu for Platform - [Block 64](https://www.block64.com/) - [Why Block 64?](https://www.block64.com/#:~:text=What%20makes%2CBlock%2064%20different) - Solutions Show submenu for Solutions - [Unified Visibility](https://www.block64.com/solutions/unified-visibility) - [Cost Optimization](https://www.block64.com/solutions/cost-optimization) - [Proactive Security](https://www.block64.com/solutions/proactive-security) - [Compliance](https://www.block64.com/solutions/continuous-compliance) - Learn Show submenu for Learn - [Quick Start Guides](https://support.block64.com/getting-started) - [Integrations](https://support.block64.com/documentation#integrations) - [Blog](https://www.block64.com/blog) - Support Show submenu for Support - [Trust Center](https://trust.block64.com/) - [Service Health](https://status.block64.com/) - [Partners](https://www.block64.com/partners) - [Contact Us](https://www.block64.com/contact) - [Pricing](https://www.block64.com/pricing) - [Get Started Free](https://www.block64.com/free-trial) - - [Customer Portal](https://customerportal.block64.com/tickets-view) - [Submit a Support Request](https://support.block64.com/kb-tickets/new) [Submit a Support Request](https://support.block64.com/kb-tickets/new?hsLang=en) How can we assist you today? - There are no suggestions because the search field is empty. 1. [Block 64 Support Center](https://support.block64.com/?hsLang=en) 2. [Documentation](https://support.block64.com/documentation?hsLang=en) 3. [Privacy and Security](https://support.block64.com/documentation?hsLang=en#privacy-and-security) # PHP Vulnerability, php2shell (CVE-2026-109618 / CVE-2026-109619) PHP runtime upgrade.  PHP2Shell Vulnerability (CVE-2026-109618 / CVE-2026-109619) On October 21, 2026, a critical security vulnerability known as **PHP2Shell** was publicly disclosed. The vulnerability affects the PHP software runtime used by web applications and could potentially allow attackers to execute unauthorized commands on vulnerable systems. Within 24 hours of the disclosure, Block 64 upgraded its systems to PHP 8.4.27, which includes the security fix for PHP2Shell. The update was released to all production regions as on October 22, 2026. As part of this work, Block 64 also updated supporting software components and strengthened protections around how the application handles system commands. The Insights platform, which was already running PHP 8.4, received the same security update. Follow-up Update Following the upgrade, a small number of report-generation functions required adjustments to accommodate changes in how the newer PHP version handles certain situations. These issues were resolved in Combine 5.90.2, which was deployed to all production regions on October 23, 2026. **No customer data or access was affected** during this process. For additional information about PHP2Shell, its affected versions, and available remediation guidance, consult the official PHP security advisories and the resources below. Further Information - PHP security advisories: [https://www.php.net/](https://www.php.net/) - National Cyber Security Centre of the Netherlands (NCSC-NL), PHP2Shell operational information: [https://github.com/NCSC-NL/php2shell](https://github.com/NCSC-NL/php2shell) - Plesk security advisory, CVE-2026-109618 and CVE-2026-109619: [https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk](https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk) For further information about Block 64’s response, please raise a support ticket through the Block 64 Support Center and we can answer any additional questions.   - [Getting Started](https://support.block64.com/getting-started?hsLang=en#main-content) - [Free Trial Onboarding](https://support.block64.com/getting-started?hsLang=en#free-trial-onboarding) - [Start Your Subscription](https://support.block64.com/getting-started?hsLang=en#start-your-subscription) - [Discovery Application Installation](https://support.block64.com/getting-started?hsLang=en#discovery-application-installation) - [Discovery Appliance Setup](https://support.block64.com/getting-started?hsLang=en#discovery-appliance-setup) - [Discovery Agent Deployment](https://support.block64.com/getting-started?hsLang=en#discovery-agent-deployment) - [Insights Reports](https://support.block64.com/insights-reports?hsLang=en#main-content) - [IT Asset Management](https://support.block64.com/insights-reports?hsLang=en#it-asset-management) - [Security](https://support.block64.com/insights-reports?hsLang=en#security) - [Cloud & Infrastructure](https://support.block64.com/insights-reports?hsLang=en#cloud-infrastructure) - [The Combine: User Guide](https://support.block64.com/insights-reports?hsLang=en#the-combine-user-guide) - [Troubleshooting](https://support.block64.com/troubleshooting?hsLang=en#main-content) - [Discovery: General Knowledge](https://support.block64.com/troubleshooting?hsLang=en#discovery-general-knowledge) - [Discovery: Block 64 Application](https://support.block64.com/troubleshooting?hsLang=en#discovery-block-64-application) - [Discovery: BlockBox Appliance](https://support.block64.com/troubleshooting?hsLang=en#discovery-blockbox-appliance) - [Discovery: Discovery Agent](https://support.block64.com/troubleshooting?hsLang=en#discovery-discovery-agent) - [Insights Calculations](https://support.block64.com/troubleshooting?hsLang=en#insights-calculations) - [Documentation](https://support.block64.com/documentation?hsLang=en#main-content) - [Discovery: General Knowledge](https://support.block64.com/documentation?hsLang=en#discovery-general-knowledge) - [Privacy and Security](https://support.block64.com/documentation?hsLang=en#privacy-and-security) - [Block 64 API](https://support.block64.com/documentation?hsLang=en#block-64-api) - [Integrations](https://support.block64.com/documentation?hsLang=en#integrations) - [FAQs](https://support.block64.com/faqs?hsLang=en#main-content) - [Security](https://support.block64.com/faqs?hsLang=en#security) - [Block 64 Discovery](https://support.block64.com/faqs?hsLang=en#block-64-discovery) - [New Features & Updates](https://support.block64.com/new-features-updates?hsLang=en#main-content) - [New Features & Updates](https://support.block64.com/new-features-updates?hsLang=en#new-features-updates) - [Combine](https://support.block64.com/new-features-updates?hsLang=en#combine) - [Block 64 Discovery](https://support.block64.com/new-features-updates?hsLang=en#block-64-discovery) - [Remote Discovery Agent](https://support.block64.com/new-features-updates?hsLang=en#remote-discovery-agent) - [Combine API](https://support.block64.com/new-features-updates?hsLang=en#combine-api) - [BlockBox Virtual Appliance](https://support.block64.com/new-features-updates?hsLang=en#blockbox-virtual-appliance) [![Logomark - dark](https://support.block64.com/hs-fs/hubfs/Logomark%20-%20dark.png?width=60&height=96&name=Logomark%20-%20dark.png "Logomark - dark")](http://block64.com) 300 Geary Ave, Toronto, ON M6H 2C5, Canada +1 800-875-5260 [www.block64.com](https://www.block64.com/)