Product Security Alert: Critical PHP "PHP2Shell" Vulnerabilities

CVE-2026-109618 | CVE-2026-109619 | CVE-2026-115560

Published: October 26, 2026

Executive Summary

On October 21, 2026, Wind River PSIRT was notified of critical vulnerabilities affecting PHP. Wind River initiated its established product security response process and assessed the potential impact across Wind River products. Wind River's PSIRT is responsible for coordinating the resolution of security vulnerabilities across supported products and operates in alignment with the FIRST.org PSIRT Services Framework and ISO/IEC 30111 and 29147.

Wind River Linux and eLxr Pro contain affected PHP components. Other Wind River products assessed by the team were determined not to be susceptible to CVE-2026-109618 and CVE-2026-109619.

The vulnerabilities originate in upstream PHP and can, under applicable deployment conditions, result in remote code execution. Customers using affected Wind River products should review their deployment exposure and apply the applicable Wind River-validated fixes as they become available.

Wind River is integrating and validating the upstream fixes within supported product distributions and will provide updates through the Wind River Security Center and Wind River support channels.

Vulnerability Details

CVE-2026-109618

CVE-2026-109618 is a PHP request-handling memory-corruption vulnerability that may result in unauthenticated remote code execution under applicable conditions. The vulnerability is associated with improper handling of memory state following allocation failures during PHP request processing. It carries a CVSS v4.0 score of 9.2 (Critical).

For authoritative vulnerability information, refer to the CVE Record: CVE-2026-109618.

CVE-2026-109619

CVE-2026-109619 is a PHP request-handling memory-corruption vulnerability that may result in unauthenticated remote code execution under applicable conditions. The issue can cause stale references to request memory to persist following request processing. It carries a CVSS v4.0 score of 9.2 (Critical).

For authoritative vulnerability information, refer to the CVE Record: CVE-2026-109619.

CVE-2026-115560

CVE-2026-115560 is a separate PHP vulnerability associated with session upload progress handling. The PHP project describes exploitation as requiring an uncommon combination of configuration and application behavior and is addressing the issue through its regular release process rather than as an emergency release.

Customers should apply the applicable PHP and Wind River security updates as described below.

Wind River Product Impact

Wind River Linux

Affected component: PHP
Status: Affected.

Versions: 22, 23, 24, 25 and 26

Upstream fixes are available through PHP project. Wind River is integrating and validating the fixes across its supported LTS releases and is actively working on a hotfix.

eLxr Pro

Affected component: PHP
Status: Affected.

Versions: 12, 12.04, 26.04.02

The upstream PHP fixes have been integrated into eLxr Pro, and a fix is available via Kernel updated build to be released to mirror package feeds. Use the command line "apt-get" accessing registered mirror(s).

Other Wind River Products

Wind River's product impact assessment determined that the other Wind River products evaluated by the team are not susceptible to CVE-2026-109618 and CVE-2026-109619.

Important: The presence of an affected PHP package does not necessarily mean that a particular deployed system is exploitable. Actual exposure depends on product version, installed PHP package/version, deployment configuration, and whether PHP processing is exposed to untrusted HTTP requests. Public industry guidance similarly distinguishes installed components from actual deployment exposure.

Recommended Customer Actions

Wind River recommends that customers using Wind River Linux or eLxr Pro:

  1. Determine exposure. Identify deployments containing affected PHP packages and assess whether PHP services process requests from untrusted networks.
  2. Apply validated fixes. eLxr Pro customers should obtain and apply the available Wind River fix through established Wind River support/update channels. Wind River Linux customers should monitor Wind River security and support resources for validated hotfix and RCPL availability.
  3. Update PHP where independently deployed. Upstream corrected PHP releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  4. Prioritize externally exposed systems. Systems processing untrusted HTTP requests warrant particular attention because network exposure is relevant to exploitation of these vulnerabilities.

Customers should use Wind River-provided or Wind River-validated packages for supported Wind River product deployments to maintain product supportability and compatibility.

Wind River Response

Wind River PSIRT will continue to track these vulnerabilities, coordinate product remediation, and publish relevant updates as additional information and validated product fixes become available.

Wind River's Security Center provides centralized security alerts, CVE resources, fixes and patches, PSIRT information, and security notices.

For the latest Wind River information, visit the Wind River Security Center.

Additional Resources

Wind River customers who require additional information or assistance should contact Wind River Customer Support or their local Wind River sales representative.

Customers using Wind River software as a component of a third-party device or system should contact the device or system manufacturer for product-specific guidance.