Neat Statement – October, 2026: Critical PHP Remote Code Execution Vulnerabilities (PHP2Shell)

Advisory ID: NEAT-SA-2026-10-22-1
Publication date: October 22, 2026
Last updated: October 22, 2026

Severity: Critical. CVSS Base Score: 9.2. This is the severity of the underlying PHP vulnerabilities. Neat has determined that they do not affect Neat products.
CVE IDs: CVE-2026-109618, CVE-2026-109619

Summary

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities in the PHP language runtime. Both can allow unauthenticated remote code execution. They affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and could affect all PHP versions from PHP 5 onwards.

Affected Products

None. Neat completed an internal investigation and confirmed that PHP is not used in any Neat product. This includes Neat Pulse, Neat Open, and NeatOS on all Neat devices.

Neat’s internal security and web teams found that some of Neat’s corporate web assets were exposed to these PHP vulnerabilities. Those assets have since been patched or mitigated.

Impact

The following is general guidance for organizations that use PHP in their own environments and is not related to Neat products. Organizations that run an affected version of PHP directly could allow an unauthenticated remote attacker to execute arbitrary code on the affected server.

Details

• CVE-2026-109618 (RCE via out-of-memory corruption): PHP’s out-of-memory handling can interrupt it while internal request data is only partly set up. Request cleanup may then treat that invalid data as valid.
• CVE-2026-109619 (RCE via stale global state): Internal state that belongs to a request can survive after its memory has been freed. A later request handled by the same worker may then use that stale state.

The PHP project considers the risk highest for Apache with mod_php. For that setup there is a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs.

Remediation

No action is required for Neat products.

Organizations that run PHP directly should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply updated packages from their Linux distribution or LTS vendor. The PHP project no longer supports PHP 8.1 and older. Users of those versions should contact their vendor about backported fixes or upgrade to a supported version. Where immediate patching is not possible, CERT-EU recommends isolating internet-facing PHP applications from public networks until a fix can be applied.

Acknowledgements

Not applicable. The PHP security team identified and disclosed these vulnerabilities.

References

• PHP.net — Security advisory: Critical remote code execution vulnerabilities, update now
• GHSA-w8hw-w9fx-j79w — CVE-2026-109618
• GHSA-6wmf-4rv5-p3rp — CVE-2026-109619
• CERT-EU Security Advisory 2026-018 — Critical Vulnerabilities in PHP

Contact

Questions about this advisory can be directed to security@neat.no.