# InnoWorld Solutions

> InnoWorld Solutions provides remote PHP security audits, PHP upgrades and server hardening for business websites worldwide, including emergency patching for the php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on 21 October 2026.

Last updated: 2026-10-22

## php2shell (CVE-2026-109618, CVE-2026-109619)

- Two critical PHP vulnerabilities, each rated CVSS 9.2, published by the PHP project on 21 October 2026.
- CVE-2026-109618: remote code execution via memory corruption during out-of-memory handling.
- CVE-2026-109619: remote code execution via stale global state left by one request and reused by a later request on the same worker.
- No authentication required.
- Affected: all PHP versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older receive no official fix.
- Deployments affected: PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP, LiteSpeed.
- Exploitation attempts were observed before disclosure (17 October 2026) and broad exploitation has been reported since.
- Fix: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the Linux distribution security update (distributions may backport the fix without changing the version number, e.g. Ubuntu 26.04 php8.5 8.5.4-0ubuntu1.5).
- Interim mitigations (not a complete fix): see the PHP advisories, e.g. session.upload_progress.enabled=0.

## Services

- Instant remote audit: identifies the exact PHP version, build and server setup, and checks for signs of past intrusion, with zero downtime.
- Upgrade and hardening: upgrades PHP to a supported, patched release and tests the site; for legacy code, hardens the server and plans a staged upgrade.
- Verification and report: written report of findings and changes, with 30-day post-fix monitoring.
- Platforms: WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop, OpenCart, Laravel, Symfony, CodeIgniter, CakePHP, Yii and custom PHP.
- Response: reply within 4 hours. Remote service worldwide. Enquiry details kept confidential.

## Contact

- Enquiry form: https://www.innoworld.solutions/#audit-form
- WhatsApp: https://wa.me/94779233884

## Links

- [Home and php2shell advisory](https://www.innoworld.solutions/#php2shell)
- [Request an audit](https://www.innoworld.solutions/#audit-form)
- [FAQ](https://www.innoworld.solutions/#faq)
- [Privacy Policy](https://www.innoworld.solutions/privacy.php)

## Sources

- [PHP advisory CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [PHP advisory CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [PHP supported versions](https://www.php.net/supported-versions.php)
- [Ubuntu CVE-2026-109618](https://ubuntu.com/security/CVE-2026-109618)