Overview

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities can enable unauthenticated remote code execution in affected deployments and carry reported CVSS v4.0 base scores of 9.2. CVE-2026-109619 can also expose memory. The pair is also known collectively as “PHP2Shell.”

Salesforce is actively assessing its products, services, and infrastructure for potential impact. At this time, Salesforce has no evidence of exploitation affecting its systems or customer data. If we do, we will notify impacted customers without undue delay.

Organizations managing PHP-based websites, applications, or third-party software should assess those environments and apply appropriate security updates.

Salesforce is following its vulnerability response processes and actively monitoring for malicious activity. At this time, we have no intelligence indicating threat actors are actively leveraging this vulnerability in the wild. However, customers should patch on an expedited schedule: the threat environment can change suddenly.

We will continue to provide material updates through Salesforce Trust.

Guidance/Recommended Actions

Organizations operating PHP should identify potentially vulnerable deployments and update the underlying PHP runtime, not just the applications that use it, as soon as possible. Organizations unable to patch immediately should consider isolating vulnerable internet-facing systems or using the temporary risk-reduction measures in the PHP security advisory. These measures are not complete mitigations.

For Heroku customers, Heroku has published patched PHP versions for these vulnerabilities. Customers operating PHP applications on Heroku should follow Heroku’s guidance and rebuild and redeploy their applications to pick up the security updates. Customers running PHP 8.1 on Heroku-22 should review Heroku’s guidance on its backported fix and plan an upgrade to a supported version. See the Heroku PHP security update.

The Vulnerabilities

CVE-2026-109618: Memory-corruption issue; potential unauthenticated remote code execution. Refer to its individual advisory for conditions and affected versions.

CVE-2026-109619: Stale-global-state issue; potential unauthenticated remote code execution and memory disclosure. Refer to its separate advisory for conditions and affected versions.

Additional Important Information

Attacks and Exploitation: The PHP project’s security advisories document validated exploit demonstrations. CIRCL and other researchers have also described suspicious activity and possible exploitation attempts in the wild. Demonstrations and attempted attacks should not be confused with verified compromises of production systems. Available reporting does not establish the extent of successful exploitation or widespread compromise.
Mitigations: The PHP Security Team states that no complete mitigations exist and updating is the only safe choice. Its advisory describes temporary measures that reduce exposure without eliminating the vulnerabilities. CERT-EU recommends considering isolation of internet-facing PHP applications from public networks when immediate patching is not possible.
Older PHP versions: The PHP Security Team has made minimal source-code backports available for PHP 7.4, 8.0 and 8.1. Some distributions and long-term-support vendors also provide patched packages for older branches. These fixes do not restore upstream support for end-of-life versions. Upgrading to a supported version remains the preferred long-term approach.
Affected applications: PHP is used by many websites and applications, but use of PHP alone does not establish that a deployment is exploitable. Exposure depends on the running PHP version, patch status and configuration. Check with your application vendor or hosting provider if you cannot determine your exposure.