GetPageSpeed security advisory

GPSA-2026-0001: PHP2Shell: remote code execution in PHP (CVE-2026-109618, CVE-2026-109619)

Critical (source: github.com) · issued 2026-10-22 · updated 2026-10-30 · revision 1

PHP2Shell fixes for every PHP branch GetPageSpeed ships, in both the base-name (php-*) channels and the version-prefixed software collections (phpNN-php-*).

PHP2Shell is a pair of PHP engine flaws rated Critical by the PHP project:
CVE-2026-109618 (GHSA-w8hw-w9fx-j79w, RCE via out-of-memory state
corruption) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, RCE via stale global
state). Upstream fixed them in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
GetPageSpeed backported the fix to every end-of-life branch it ships,
PHP 5.3 to 8.1.

After updating: restart PHP-FPM (systemctl restart php-fpm or phpNN-php-fpm) and Apache httpd if it runs mod_php.

Fixed packages

Every build listed in the signed repository metadata (yum updateinfo info GPSA-2026-0001). mitigation means a backported fix, not the complete upstream change.

Update

yum updateinfo list GPSA-2026-0001
yum update --advisory=GPSA-2026-0001

References

• CVE-2026-109618 — RCE via OOM corruption
• CVE-2026-109619 — RCE via stale global state
• GHSA-w8hw-w9fx-j79w
• GHSA-6wmf-4rv5-p3rp
• PHP2Shell — PHP2Shell checker and fix guide

All advisories · JSON feed · GetPageSpeed repository