CVE-2026-19618

On October 21, 2026, two critical remote code execution (RCE) vulnerabilities, collectively known as "PHP2Shell", were disclosed in the PHP core. These vulnerabilities exploit a heap use-after-free (UAF) condition in PHP's session upload progress mechanism, enabling unauthenticated remote code execution. Both vulnerabilities have a CVSS v4.0 base score of 9.2 (Critical) and affect all PHP versions from 5.x onward.

Qumulo has evaluated these vulnerabilities and confirmed that no Qumulo products are affected.

Impact Assessment

Qumulo products do not include PHP in their software stack. Because PHP is not present in any Qumulo product, these vulnerabilities cannot be exploited against Qumulo systems. No action is required for Qumulo customers with respect to their Qumulo deployments.

Recommendations

While Qumulo products are not affected, customers running PHP in other parts of their environment should apply vendor patches immediately. PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. End-of-life PHP branches will not receive patches. Proof-of-concept exploit code is publicly available; active exploitation is expected.

Contact

For questions about this advisory, contact Qumulo Support or your account team.