Two critical vulnerabilities in the PHP runtime, known collectively as PHP2Shell, could allow a remote attacker to execute code on a vulnerable PHP server in certain circumstances. The vulnerabilities are CVE-2026-109618 and CVE-2026-109619.
Total Defense has applied the vendor-provided fixes for both vulnerabilities to the environments supporting totaldefense.com. No action is required from Total Defense customers. These vulnerabilities affect PHP running on servers; they do not indicate that Total Defense software installed on customer devices is vulnerable.
CVE-2026-109618 involves PHP’s handling of out-of-memory conditions, which may leave request data in an invalid state. CVE-2026-109619 involves PHP worker processes retaining references to memory from an earlier request. Depending on the PHP version, server configuration, and application environment, these issues may lead to remote code execution.
Customers who operate their own PHP-based website or server should contact their hosting provider or system administrator to confirm that PHP has been updated with the appropriate fix from their operating-system or PHP vendor. More information: