ncsc-nl/php2shell is a repository where the Dutch national cybersecurity agency collects and manages operational information about the 2026 php2shell vulnerabilities. It provides affected software and response materials for two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. No latest release information is given, and this repository is not itself an implementation that fixes the vulnerabilities.
The purpose of this material is to help operators check whether patches are available and what temporary mitigations exist. The README lists fixed releases for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, along with guidance on end-of-life (EOL) versions and on how distributors backport fixes. It also provides detection and mitigation materials, related tools, and the software status per vendor. As a temporary mitigation it explains how to disable the in-progress session upload feature and restart workers, but states clearly that this is not a complete fix.
The core of the repository is a list of advisories and affected-status entries; no fix code of its own can be confirmed. The per-software status table is still being expanded, so it should not be read as a definitive list in which the impact on every product has been settled. Therefore, applying the patched versions should be prioritised, and products that are absent from the table should be judged as products whose impact status has not yet been stated.