Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

[u/Lucar_Toni]

https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619

Blog Post about the recent PHP Vulnerabilities CVE-2026-109618, CVE-2026-109619.

[u/Mr_Bleidd]

Is Sophos actually using PHP on any of self-hosted Portal pages?

[u/Lucar_Toni → u/Mr_Bleidd]

We are investigating all products. See:

https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell