PHP2Shell Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): Patched Across AWR Servers

TL;DR: AWR was patched against both vulnerabilities on October 21, 2026 at 17:00 UTC, about three hours after the official PHP fix was released. Temporary mitigations were in place before that. No customer data was accessed or affected, and no action is required on your part.

On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, widely referred to as "PHP2Shell". Both allow an unauthenticated attacker to execute code remotely on servers running unpatched versions of PHP. Security researchers have reported active exploitation attempts.

As soon as the vulnerabilities were disclosed, we applied temporary mitigations across the AWR web app, API and website: we disabled PHP's session upload progress feature and deployed AWS WAF rules that block the crafted multipart requests used to trigger the flaws. These measures were in place before a patch was available.

Once the PHP project released the fixed versions at 14:00 UTC, we upgraded all AWR servers to patched PHP versions. The upgrade was completed at 17:00 UTC the same day.

We reviewed our server logs from October 17, 2026, the date of the earliest publicly reported exploitation attempt, through to the completion of the patch. We found no evidence that these vulnerabilities were exploited against AWR systems. No customer data was accessed, and no action is required on your part.

Technical details: CVE-2026-109618 and CVE-2026-109619, rated Critical (CVSS 9.8). Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. See the official PHP changelog.

We are publishing this advisory in the interest of full transparency, as we believe open disclosure is essential to maintaining your trust. This advisory will be updated if new information emerges.

If you have any questions, please do not hesitate to reach out at help@advancedwebranking.com.

Last updated: October 22, 2026