Is the OESIS Framework Affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

Overview

PHP2Shell refers to two security vulnerabilities in the PHP interpreter: CVE-2026-109618 and CVE-2026-109619. Both were disclosed by the PHP project on October 21, 2026 and are rated Critical (CVSS v4.0 9.2). Under certain conditions, an affected PHP runtime that serves web requests may allow unauthenticated remote code execution before application code runs. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Product Assessment

The following components were assessed:

The OESIS Framework SDK is distributed as native compiled libraries and does not embed, bundle or depend on a PHP interpreter at build time or at runtime. The OESIS content delivery services do not run PHP. None of the assessed components are therefore susceptible to these PHP interpreter vulnerabilities.

Is Any Action Required?

No product-specific patch, hotfix, SDK update or configuration change is required for the OESIS Framework to address these two PHP vulnerabilities.

If PHP is installed on an endpoint as part of another application or service, it must be assessed and patched independently. Where PHP is a product supported by the OESIS Vulnerability module, the SDK reports CVE-2026-109618 and CVE-2026-109619 against detected installations once the corresponding vulnerability data is published, in line with the standard data update cadence.

Note: This article addresses only the two CVEs above. It does not assess other vulnerabilities, the customer's own application that integrates the SDK, or independently installed third-party software.

Additional Resources

• PHP Security Release Information, October 21, 2026

• GitHub Security Advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)

• GitHub Security Advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

• Is MetaDefender Core Affected by PHP2Shell?

This article was last updated on 2026-10-23.