{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","title":"PHP2Shell (CVE-2026-109618 and CVE-2026-109619)","distribution":{"tlp":{"label":"CLEAR"}},"publisher":{"category":"vendor","name":"WatchGuard PSIRT","namespace":"https://www.watchguard.com"},"tracking":{"id":"WGSA-2026-0032","status":"final","version":"29","initial_release_date":"2026-10-21T19:51:02.797758+00:00","current_release_date":"2026-10-21T19:50:49.141043+00:00","revision_history":[{"date":"2026-10-21T19:51:02.797758+00:00","number":"29","summary":"Initial release."}]},"references":[{"summary":"vendor-advisory","url":"https://psirt.watchguard.com/WGSA-2026-0032"},{"summary":"cve","url":"https://www.cve.org/CVERecord?id=CVE-2026-109618"},{"summary":"cve","url":"https://www.cve.org/CVERecord?id=CVE-2026-109619"}],"notes":[{"category":"summary","text":"On October 21, PHP published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35  to address two critical severity vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that were leaked as a zero-day the day before. Both vulnerabilities are pre-authentication remote code executions which have been given the name PHP2Shell.\n\nWatchGuard's initial assessment is that none of our products are affected by this vulnerability. We are continuing to review and will update this advisory with any new findings.","title":"Summary"}]}}