Security Advisory: PHP2Shell critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Key points for customers 

 

  • On 21 October 2026, the PHP project released fixes for two critical vulnerabilities in the PHP engine, known as PHP2Shell. They allow an unauthenticated attacker to run code on servers that use PHP to serve web requests. 
  • NetApp Instaclustr managed services do not use PHP. Clusters on the Instaclustr Managed Platform are not affected, and no action is required on your clusters. 
  • Two internal NetApp Instaclustr management systems used affected PHP components. Neither of these systems has access to customer instances. Additionally, neither system accepts connections from the internet and are subject to restricted network access controls already. 
  • NetApp Instaclustr has patched one system and further restricted access to the other while we wait for the vendor’s fix. 
  • We have found no evidence that either system was exploited and no customer cluster or customer data was affected. 
  • If your own applications use PHP, including applications that connect to your NetApp Instaclustr Managed clusters, we would like to advise you to update PHP on those servers now. 

 

CVEs 

 

CVE  Public Name  Area Affected  CVSS 4.0 Score  NetApp Assessed Score for Instaclustr Managed Platform 
CVE-2026-109618  PHP2Shell (out-of-memory corruption)  How PHP handles running out of memory partway through a request  9.2 (Critical)  0, N/A: PHP is not present on managed nodes 
CVE-2026-109619  PHP2Shell (stale global state)  How PHP resets internal state between requests after an error  9.2 (Critical)  0, N/A: PHP is not present on managed nodes 

 

Impact analysis 

 

NetApp performed an investigation into these vulnerabilities and their potential impact on Instaclustr Managed Platform customers, Enterprise Support customers, and NetApp Instaclustr’s own systems. 

 

  • PHP is not installed on Instaclustr managed nodes and is not used by the Instaclustr Console or APIs. These vulnerabilities have no impact on existing or new clusters, including BYOC and On-Prem deployments. 
  • The open-source technologies covered by Enterprise Support do not depend on PHP. 

 

If you have further questions about these vulnerabilities, contact NetApp Instaclustr Support. Existing customers can also raise a support ticket through the support portal.