PHP2Shell: GitLab helps find and remediate critical PHP flaws
PHP fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws are in the PHP engine, so framework or application changes do not mitigate them, and any web server running PHP is affected. GitLab says its own products are not affected and describes how to use container scanning and code search to find PHP runtimes in projects.
What changes for platform teams
Platform teams need to upgrade PHP runtimes in hosts and container images, rebuild images with docker build --pull, and check for PHP installed from source, which container scanning cannot detect. Runtime inventory is needed alongside repository scans to find PHP workloads outside GitLab projects.
Read the original at GitLab Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules