PHP Critical Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Last Updated:
Overview
Two critical pre-authentication remote code execution vulnerabilities, collectively referred to as PHP2Shell, affect core PHP runtime versions 5.4.0 through 8.5.11:
-
CVE-2026-109618: Remote code execution via out-of-memory corruption during request parsing.
-
CVE-2026-109619: Remote code execution and memory disclosure via stale global state across persistent worker processes.
Both vulnerabilities carry a CVSS v4.0 base score of 9.2 (Critical).
No Auth0 SDK Updates Are Required
All Auth0 PHP SDKs, plugins, and sample repositories are fully compatible with patched PHP runtimes out of the box. This includes:
- auth0/auth0-PHP (github.com/auth0/auth0-PHP)
- auth0/laravel-auth0 (github.com/auth0/laravel-auth0)
- auth0/symfony (github.com/auth0/symfony)
- auth0/wordpress (github.com/auth0/wordpress)
- auth0/php-jwt-example (github.com/auth0/php-jwt-example)
- auth0-samples/auth0-php-api-samples (github.com/auth0-samples/auth0-php-api-samples)
- auth0-samples/auth0-php-web-app (github.com/auth0-samples/auth0-php-web-app)
- auth0-samples/laravel (github.com/auth0-samples/laravel)
Update to a Safe PHP Runtime
Customers hosting PHP applications must ensure their underlying runtime environment runs one of the patched releases:
- PHP 8.5.12 or higher
- PHP 8.4.27 or higher
- PHP 8.3.36 or higher
- PHP 8.2.35 or higher
References
