Security Alert CVE-2026-109618 and CVE-2026-109619

October 25, 2026 1 minute read

Oracle has released Security Alert CVE-2026-109618 and CVE-2026-109619, to address two PHP vulnerabilities collectively known as PHP2Shell, which may allow unauthenticated remote code execution. The highest CVSS v3.1 Base Score for these vulnerabilities is 9.8.

Oracle strongly recommends that customers apply the available security patches without delay.

Oracle customers should refer to the Security Alert Advisory for detailed guidance, published at https://www.oracle.com/security-alerts/alert-cve-2026-109618.html. The advisory will continue to be updated as additional product patches become available.

Integrated Cyber Center (ICC)

Oracle’s Integrated Cyber Center (ICC) serves as the enterprise hub for orchestrating Oracle’s global incident response, customer trust, and strategic security communications. By unifying people, processes, and intelligence across the organization, the ICC ensures Oracle operates as one enterprise with one voice—protecting customers, strengthening transparency, and driving continuous evolution of our collective security posture.

Security Alert CVE-2026-109618 and CVE-2026-109619

Authors

Integrated Cyber Center (ICC)

Security Alert CVE-2026-114820