Checked fact 255723 Oct 2026Safety and security

watchTowr says: "Put simply: if you have not applied the update, your deployment of PHP is vulnerable." and "Every installation that serves PHP web requests is affected, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP." This differs from or adds to other sources: Stated without the per-SAPI conditions in PHP's advisories, which describe FPM as susceptible with no complete FPM exploit for CVE-2026-109618, and as dependent on a suitable application operation for the CVE-2026-109619 session path.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

Put simply: if you have not applied the update, your deployment of PHP is vulnerable. ... Every installation that serves PHP web requests is affected, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP.

What the source said when we opened it, on 23 Oct 2026.

The source

PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)
watchTowr · 2026-10-21

Open the source

Checked

Checked by the notis newsroom on 23 Oct 2026, against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026

Cite this fact

Short permanent address

In a sentence

“watchTowr says: "Put simply: if you have not applied the update, your deployment of PHP is vulnerable." and "Every installation that serves PHP web requests is affected, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP." This differs from or adds to other sources: Stated without the per-SAPI conditions in PHP's advisories, which describe FPM as susceptible with no complete FPM exploit for CVE-2026-109618, and as dependent on a suitable application operation for the CVE-2026-109619 session path.” ai notis, checked 23 Oct 2026. Source: PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619) (watchTowr). https://ainotis.com/c/2557

As a reference (APA style)

ai notis. (2026, October 23). watchTowr says: "Put simply: if you have not applied the update, your deployment of PHP is vulnerable." and "Every installation that serves PHP web requests is affected, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP." This differs from or adds to other sources: Stated without the per-SAPI conditions in PHP's advisories, which describe FPM as susceptible with no complete FPM exploit for CVE-2026-109618, and as dependent on a suitable application operation for the CVE-2026-109619 session path [Checked claim 2557]. ai notis. https://ainotis.com/c/2557

Anyone may quote this address. It does not change; if we correct the story, this page says so.