CVE-2026-109618 / CVE-2026-109619 — PHP2Shell

In October 2026, two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were announced in the PHP core, also known as "PHP2Shell". See for example the Tenable FAQ for more information.

Exploitation requires that the target system runs PHP.

Impact to LiquidFiles

Does this impact LiquidFiles — No.

LiquidFiles does not use PHP. LiquidFiles is built on Ruby on Rails, and there is no PHP interpreter, PHP-FPM, or PHP-based component installed on the LiquidFiles appliance. There is therefore no code path by which these vulnerabilities can be reached. This applies to every LiquidFiles version.

No action is required by LiquidFiles administrators, and no LiquidFiles update is needed to address CVE-2026-109618 or CVE-2026-109619.