Advisories
PHP security advisories, curated and triaged.
The advisories Shellproof checks against, each taken from the official PHP source. Every row links to the primary source. For the complete, machine-readable PHP release history, see /data/php-releases.json.
| CVE | Severity | CVSS | Fixed in | Details |
|---|---|---|---|---|
| CVE-2026-109618 PHP2Shell — RCE via out-of-memory state corruption | Critical | 9.2 v4.0 | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 | Advisory → |
| CVE-2026-109619 PHP2Shell — RCE via stale request state (use-after-free) | Critical | 9.2 v4.0 | 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 | Advisory → |
| CVE-2024-4577 PHP-CGI argument injection on Windows (Best-Fit) | Critical | 9.8 v3.1 | 8.1.29 · 8.2.20 · 8.3.8 | GHSA ↗ |
Click a column heading to sort. CVE-2024-4577 is listed in CISA's Known Exploited Vulnerabilities catalogue. Affects Windows php-cgi installs.
PHP2Shell, in depth
The full advisory: what the two flaws are, which SAPIs are exposed, the interim mitigations and the fix.
CVE-2026-109618 · -109619Explore →
Check your version
Paste a PHP version or phpinfo and find out instantly whether you are patched, outdated or end-of-life.
Version checkerExplore →
Fix it
Platform-specific upgrade, restart and verify commands, plus interim mitigations for while you patch.
Fix playbooksExplore →
Sources
- PHP advisory announcements, October 2026 — php.net/archive/2026.php
- CVE-2026-109618 — GHSA-w8hw-w9fx-j79w
- CVE-2026-109619 — GHSA-6wmf-4rv5-p3rp
- CVE-2024-4577 — GHSA-3qgc-jrrr-25jv · CISA KEV