Actions to Take:
Notify your Information Technology department immediately and review the corrective actions below. Customers using PHP for their websites or other applications should contact their website developer, system administrator, or hosting provider to arrange the required security updates.
Issue:
The PHP development team has released security updates addressing two critical vulnerabilities known collectively as PHP2Shell: CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 in severity. These vulnerabilities can allow attackers to execute malicious code on affected servers without logging in.
Impact:
Successful exploitation could allow attackers to access or modify information, install malicious software, or disrupt services, subject to the permissions of the affected PHP process. In some configurations, an attack can occur before the website’s application code or login checks run.
Unpatched PHP installations serving web requests are potentially at risk. Exposure is not limited to a particular website platform or hosting configuration.
Essent Service Impact:
Essent does not use PHP in Essent products and services and are not impacted by these vulnerabilities. No corrective action is required for Essent products or services.
Customers using PHP for custom website development, or operating Web Content Management Systems and ecommerce systems that use PHP — including, but not limited to, popular systems like WordPress, WooCommerce, OpenCart, Magento, Joomla!, and Drupal — are within the scope of this notice. These platforms depend on PHP, and installations running vulnerable, unpatched PHP versions require corrective action.
Affected customers should have their Information Technology department, website developer, or hosting provider review their PHP installations and apply the required security updates immediately.
Contact
Essent Support for questions about Essent products and services. Custom PHP integrations are not covered under regular support. For PHP updates and security patches, contact your PHP application support team or hosting provider.
Corrective Action:
Update affected PHP installations to the applicable fixed release below, or install a vendor-provided update explicitly confirmed to address both vulnerabilities.
Current Version Minimum Fixed Version
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35
These releases contain the fixes for both vulnerabilities.
For PHP 8.1 and earlier, upgrade to a supported release or obtain a vendor-confirmed security fix. Configuration changes alone do not provide complete protection.
Confirm that the underlying PHP installation has been updated. Updating website software, themes, or plugins alone does not establish that the server’s PHP installation has received the required fixes. Your hosting provider or system administrator should verify the PHP update separately.
More information:
PHP security advisory and release announcements — October 21, 2026
CVE-2026-109618 — Official PHP security advisory
CVE-2026-109619 — Official PHP security advisory
NIST National Vulnerability Database — CVE-2026-109618
NIST National Vulnerability Database — CVE-2026-109619