CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP

Aleksei Masliannikov

Updated October 22, 2026 08:35

Applicable to:

SolusVM
SolusVM 2

Situation

Critical security vulnerabilities were found in PHP, and have been assigned CVE-2026-109618 and CVE-2026-109619

For more information, you can find the official announcement here:
PHP News Archive | 21 Oct 2026

Affected Product Versions

Product / Component	Affected Versions	Patched Version
SolusVM	All SolusVM versions up to 1.30.11	1.30.18
SolusVM 2	All SolusVM 2 versions up to 2.0.0-44739	2.0.0-44868

Impact

All shipped PHP versions are suspected to be vulnerable at this time. Successful exploitation of this vulnerability can allow remote code execution (RCE) on affected PHP versions.

Call to action

SolusVM

Update SolusVM installation to the version 1.30.18 or later.

SolusVM 2

Update SolusVM 2 installation to the version 2.0.0-44868 or later.