Blog October 22, 2026 ExeOutput for PHPSoftware

PHP2Shell: Patched PHP Runtimes for ExeOutput for PHP 2025

On October 21, 2026, the PHP team fixed two critical remote code execution vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

Patched runtimes (PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12) are now available for ExeOutput for PHP 2025. Install them with Web Update (Check For Updates in ExeOutput), then rebuild and redistribute your applications: the PHP runtime is embedded in each EXE you build.

phpinfo() of an ExeOutput for PHP application running the patched PHP 8.5.12 runtime, built on October 20, 2026

ExeOutput itself is unchanged, so your license and maintenance period are not affected. If you do not have ExeOutput for PHP 2025 yet, get it from the download page.

Read the full details, including mitigations and notes on older PHP versions: PHP2Shell Security Update for ExeOutput for PHP 2025.