PHP CVE-2026-109618 / CVE-2026-109619, aka “PHP2Shell”
| Advisory ID | CVE Number | Date discovered | Severity | Advisory revision |
|---|---|---|---|---|
| STORM-2026-033 | CVE-2026-109618 , CVE-2026-109619 | 10/21/2026 | None | v2 |
Vulnerability details
No Stormshield product is affected by vulnerabilities CVE-2026-109618 and CVE-2026-109619: these flaws affect the PHP interpreter, which no Stormshield product embeds or uses. No customer action is required on Stormshield products.
The Stormshield cloud infrastructure behind the Autobackup service does use PHP. As a strict preventive measure, an emergency patch is being applied, and the Autobackup service has been in exceptional maintenance since the night of October 21, 2026.
Vulnerabilities
On October 20, 2026, the PHP security team announced two critical remote code execution vulnerabilities in the PHP interpreter (dubbed “PHP2Shell”). Fixes were released on October 21, 2026 at 14:00 UTC.
| CVE | Type | CVSS v4.0 | Component |
|---|---|---|---|
| CVE-2026-109618 | Remote code execution | 9.2 (Critical) | PHP interpreter |
| CVE-2026-109619 | Remote code execution | 9.2 (Critical) | PHP interpreter |
Any application running on a vulnerable PHP version is potentially exposed, regardless of the application itself.
Stormshield products assessed
| Product | Status | Action required |
|---|---|---|
| Stormshield Network Security (SNS) – physical and virtual firewalls | Not affected | None |
| Stormshield Management Center (SMC) | Not affected | None |
| Stormshield Endpoint Security Evolution (SES Evolution) | Not affected | None |
| Stormshield Data Security (SDS) | Not affected | None |
| Stormshield Log Supervisor (SLS) | Not affected | None |
Stormshield online services
| Service | Status |
|---|---|
| Autobackup (cloud backup of SNS configurations) | Exceptional maintenance – preventive emergency patch in progress
|
Technical rationale
The vulnerabilities reside in the PHP interpreter. Exploitation requires a vulnerable PHP interpreter to be present and to process attacker-controlled requests or data.
No Stormshield product includes a PHP interpreter, whether as a web server module (PHP-FPM, mod_php, CGI) or as a command-line binary. The vulnerable code is therefore absent from the products.
VEX status: not_affected, justification component_not_present.
Recommendations
No action is needed on Stormshield products.
Autobackup users: until the service is restored, make local backups of your SNS configurations, and retrieve existing cloud backups from MyStormshield if needed.
Revisions
| Version | Date | Description |
|---|---|---|
| v1 | 10/22/2026 | Initial release |
| v2 | 10/28/2026 | Add Product |
