On 21 October 2026 the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (“php2shell”). They affect PHP installations that serve web requests, going back to PHP 5.4. Exploitation attempts have been reported in the wild.
IronTree platforms: patching and mitigation of affected IronTree systems is in progress. Status updates for specific services will be posted separately.
Client-hosted systems: clients are responsible for patching PHP and the applications that run on it. Please update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution’s patched package), restart PHP services, and upgrade any end-of-life PHP versions as soon as possible. IronTree is identifying vulnerable client systems and will contact affected clients directly.
We encourage you to review you applications for the affected PHP version and should you suspect your applications are vulnerable, you should patch as soon as possible.
If you’d like extra snapshots or backups taken before patching, contact support by emailing vps@irontree.co.za