CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP

Aleksei Masliannikov

Updated October 21, 2026 13:56

Applicable to:

SolusVM
SolusVM 2

Situation

Critical security vulnerabilities were found in PHP, and have been assigned CVE-2026-109618 and CVE-2026-109619.

At this time, full disclosure on these vulnerabilities has not been made public. All current public information is available at the following:
PHP News Archive | 20 Oct 2026

Affected Product Versions

Product / Component	Affected Versions	Patched Version
SolusVM	All SolusVM versions up to 1.30.11	Pending fix
SolusVM 2	All SolusVM 2 versions up to 2.0.0-44739	Pending fix

Impact

All PHP versions are suspected to be vulnerable at this time. Further details will be provided once made available. Both vulnerabilities are rated critical. Remote code execution (RCE) is possible on affected PHP versions.

Call to action

SolusVM

A fix is pending from the PHP vendor and is not available yet. When it is released:

Update SolusVM once the update with the fix will be available.

SolusVM 2

A patched SolusVM 2 version has not been released yet. When it is released:

Update SolusVM 2 once the update with the fix will be available.