Oracle has released Security Alert CVE-2026-109618 and CVE-2026-109619 to address two PHP vulnerabilities collectively known as PHP2Shell, which may allow unauthenticated remote code execution. The highest CVSS v3.1 Base Score for these vulnerabilities is 9.8.
PHP2Shell vulnerabilities and risk
The two tracked flaws, CVE-2026-109618 and CVE-2026-109619, are identified together under the PHP2Shell name and pose the potential for unauthenticated remote code execution, according to Oracle. Oracle reports a maximum CVSS v3.1 Base Score of 9.8 for these issues.
Oracle guidance and patches
Oracle strongly recommends that customers apply the available security patches without delay. Customers should refer to the Security Alert Advisory for detailed guidance at https://www.oracle.com/security-alerts/alert-cve-2026-109618.html; the advisory will continue to be updated as additional product patches become available.
