This article describes Flexera's position regarding two critical vulnerabilities in PHP web runtimes commonly referred to as "PHP2Shell": CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.

Flexera is actively assessing the potential impact of these vulnerabilities across our products and environments.

Flexera product infrastructure scanning and hardening

As part of our response, Flexera Product Security Operations has completed scanning of our infrastructure. No vulnerable systems have been identified at this stage.

We have also deployed updated Web Application Firewall (WAF) protections designed to detect and block potential exploitation attempts associated with these vulnerabilities. Our Product Security and Engineering teams are continuing to validate underlying systems and product components as our investigation progresses.

Status of Flexera-hosted services

Our teams are continuing to assess Flexera-hosted environments and apply appropriate protections and remediation where required. 

For customers using Flexera software components on-premises

At this point in time, investigations have not identified any Flexera components used on customers' premises that are exposed to these vulnerabilities, except as specifically noted below.

RN150 appliance

Flexera has updated the appliance in response to these vulnerabilities, and the appliance will be updated in customer infrastructure when its auto-update process runs. Customers wanting to expedite fixes can deploy the latest version of the RN150 appliance.

Further questions and updates

Customers with questions about a specific Flexera product or deployment should contact Flexera Support.

We are continuing to monitor the situation and will update this advisory as additional information becomes available.