The PHP project has released patches for the PHP2Shell vulnerability (CVE-2026-109618 / CVE-2026-109619). More information about the vulnerability and patches is available at:
We've already done the following:
- Deployed the recommended mitigations for
session.upload_progress and memory_limit on all servers.
- Deployed patched PHP versions on our AlmaLinux 9 servers.
We're still building updated packages for our older CentOS 7 servers and hope to have those servers updated later today.
We'll update this announcement and email all customers after all servers have been patched.
