Critical PHP Security Vulnerabilities: SWOOP Security Update on PHP2Shell

Published: 22 October 2026, 8:22am AEDT

Category: Security Advisory | Product & Infrastructure Updates

Overview

On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, collectively referred to as PHP2Shell.

These vulnerabilities affect the core PHP runtime and could allow unauthenticated attackers to execute malicious code remotely or access sensitive information under certain conditions.

The vulnerabilities have been assigned the following identifiers:

Vulnerability	Description	Severity
CVE-2026-109618	Remote code execution through memory corruption during out-of-memory handling	Critical
CVE-2026-109619	Remote code execution through improper handling of internal PHP state between requests	Critical

Both vulnerabilities have a CVSS v4.0 severity score of 9.2.

What Is SWOOP Analytics Doing?

Following the disclosure, SWOOP Analytics initiated a security review of its affected infrastructure and began implementing the temporary mitigations recommended by the PHP security team.

Our completed response as of now includes:

Immediate configuration mitigation: Disabling PHP's session-based upload-progress functionality on applicable servers to reduce exposure to known exploitation paths.
Runtime protection: Restarting affected PHP-FPM services to ensure updated security configurations are applied to running processes.
Security assessment: Reviewing affected PHP installations, configurations, and available security updates.
Patch management: Tracking the availability of patched PHP packages from our operating system vendors and preparing their deployment following compatibility validation.
Ongoing monitoring: Reviewing relevant security events and runtime behaviour for indicators of potential exploitation.

These measures are part of our ongoing security response. The temporary configuration changes reduce risk but do not fully eliminate the underlying vulnerabilities.

When Will the Permanent Security Fix Be Applied?

The PHP development team has released the following patched versions:

PHP Branch	Patched Version
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12

While the official security updates are available, deployment through Linux distribution repositories depends on the availability of compatible vendor packages.

SWOOP Analytics is monitoring these releases and will prioritize deploying verified security patches across affected infrastructure, subject to the necessary application compatibility and operational checks.

Is Any Customer Action Required?

No immediate customer action is required for SWOOP-managed infrastructure.

Our technical and security teams are coordinating the necessary remediation activities.

Customers operating independently managed PHP applications or integrations should consult their own infrastructure administrators to ensure that applicable PHP security updates are installed.

Are SWOOP Services Affected?

The vulnerabilities exist within the PHP runtime rather than being specific to SWOOP Analytics or its application code.

We are assessing the relevant infrastructure components and implementing the recommended protective measures. The disclosure of these vulnerabilities does not, by itself, indicate that customer information has been compromised.

Our Continued Commitment to Security

Protecting customer information and maintaining the security and reliability of our services remain priorities for SWOOP Analytics.

We will continue reviewing the situation, implementing appropriate safeguards, and deploying permanent security updates as verified packages become available.

This article may be updated as our remediation activities progress.

Further Information

For additional technical details, please refer to:

For questions about this advisory or the security of SWOOP Analytics services, please contact SWOOP Analytics Support through your existing in-app support channel or by writing to us on support@swoopanalytics.com.