TL;DR

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may allow remote code execution in affected applications. Both are rated CVSS v4.0 9.2. See the CERT-EU advisory 2026-018.

Action required: rebuild and redeploy your PHP applications now to apply a temporary, partial workaround included in the Scalingo PHP buildpack. This does not replace the patch: Scalingo will make patched PHP versions available as soon as possible after their upstream release.

What Happened?

On October 20, 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities, scheduled for October 21, 2026 at 14:00 UTC (16:00 UTC+2). The CVE identifiers and scores above are those reported by CERT-EU.

No technical details, affected versions or fixed versions have been published yet. We are assessing the impact on PHP applications hosted on Scalingo.

Incident Analysis

CERT-EU reports that the vulnerabilities could allow remote code execution in affected PHP applications. The actual impact on a given application depends on its deployment and permissions.

Disabling PHP session upload progress reduces exposure to one reported attack path. It does not establish protection against both vulnerabilities.

What We Did

We updated the PHP buildpack to disable session upload progress in php.ini and enforce this setting in the PHP-FPM pool. The updated buildpack is available for application deployments.

Existing applications using the Scalingo PHP buildpack must be rebuilt and redeployed to receive the update. Restarting an application does not update its embedded PHP runtime or configuration. Applications using a custom, forked or pinned buildpack do not receive the change automatically.

What You Should Do

Some failed deployments can leave the previous version running without the workaround. See deployment error behavior.

1. Check that both your PHP version and Scalingo stack are supported. See PHP availability by stack and stack status.
2. Rebuild and redeploy each application with the Scalingo PHP buildpack to disable PHP session upload progress (session.upload_progress.enabled); see Git deployment instructions or manual GitHub deployment.
3. To reduce exposure, restrict access to the application or scale all long-running process types to zero using the scaling instructions. This makes the web/tcp endpoints unavailable, but does not stop Scalingo Scheduler tasks or one-off containers.
4. Once a patched PHP version is available, ensure your PHP version constraint and buildpack pin allow it. Redeploy and confirm the application uses that version; this second deployment is required even after applying the workaround.

File uploads remain available, but application features using PHP upload progress no longer receive progress updates.

If you manage your own PHP runtime, disable session upload progress in php.ini:

session.upload_progress.enabled = Off

If you use PHP-FPM, you can also enforce it in the pool configuration (this syntax is only valid in PHP-FPM pool files, not in php.ini):

php_admin_flag[session.upload_progress.enabled] = off

This workaround is partial and does not protect against both vulnerabilities.

What We Will Do in the Future

Scalingo will make patched PHP versions available as soon as possible after their upstream release and update this bulletin with the versions and deployment instructions.

Product Impacts

Scalingo PaaS

PHP applications hosted on Scalingo are potentially affected. The exact affected PHP versions remain to be confirmed by the PHP security release.

Contact

Contact support@scalingo.com if you need help applying the workaround.

Timeline

Changelog

• 2026-10-21: Initial publication of SSB-2026-005. Updated PHP buildpack available. Customers must rebuild and redeploy their applications; patched PHP versions pending.
• 2026-10-21: Clarified PHP and stack requirements, deployment failures, process shutdown limits, upload progress impact, and the need to redeploy with a patched PHP version.