Advisory [CVE-2026-109618 +1] PHP2Shell Vulnerability (CVE-2026-109618/CVE-2026-109619)
This security Veeam advisory covers CVE-2026-109618 and CVE-2026-109619.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 2 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.
VulniPulse record published Record updated
Get an email when Veeam publishes the next one.
VulniPulse checks Veeam's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
PHP2Shell Vulnerability
CVE-2026-109618 | CVE-2026-109619
KB ID: 4953
Published:
Last Modified:
Impact on Veeam Software
Veeam products and Veeam SaaS solutions are not affected by this vulnerability.
PHP is not in use by any Veeam products or Veeam SaaS solutions.
General Vulnerability Details
More Information
- Wikipedia: PHP2Shell
- Veeam EULA | Open Source Software Components
- Veeam Software Appliance Repository / Mandatory External Packages
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
CISA Known Exploited Vulnerability
- Listed:
- Oct 26, 2026 · federal remediation due Oct 29, 2026
- Required action:
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV is a prioritization signal from CISA. Remediation detail comes from the vendor advisory.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · medium-confidence parse· fetched 18 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists. Confirm against the vendor advisory.
Official advisory · medium-confidence parse· fetched 18 hours ago·verify at source
Mitigation
The source record does not include mitigation steps. That does not mean no fix exists. Read the vendor advisory below for the authoritative guidance.
Official advisory · medium-confidence parse· fetched 18 hours ago·verify at source
More Veeam advisories
- CVE-2023-22793Oct 29, 2026Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1
- CVE-2025-64394Oct 27, 2026Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
- CVE-2026-105477Oct 27, 2026Release Information for Veeam Backup & Replication 13 and Updates
- KB4857Oct 27, 2026List of Security Fixes and Improvements in Veeam Recovery Orchestrator
- CVE-2026-105477Oct 27, 2026Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2
- CVE-2026-107671Oct 27, 2026Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1
Android app · Google Play
Monitor future Veeam CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.