Oct 21, 2026
On October 21, 2026, the PHP project disclosed CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP. Shibumi completed remediation the same day, and the fix is live across all environments.
Vulnerability Overview
CVE-2026-109618 is a memory corruption flaw in PHP’s out-of-memory handling, and CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both can allow unauthenticated remote code execution. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Remediation Response
Shibumi upgraded all Util Service environments to PHP 8.5.12 on October 21, 2026, within 15 minutes of available patches.
Shibumi Marketing and Support website was patched on October 21, and Shibumi University website was patched on October 22.
Shibumi does not use PHP for any other services.
Questions
Contact your Shibumi account team or [email protected].
Sources