🚨 Critical "php2shell" PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): What you need to know for your GLPI server

On October 21, 2026, at 14:00 UTC, the PHP development team released critical security updates addressing two major vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (commonly referred to as "php2shell").

Full technical details regarding these flaws, their potential security impact, and recommended workarounds can be found in the official PHP.net announcement.

Here is a breakdown of what this security advisory means for your ITSM infrastructure and how to secure your GLPI instances.

🔒 Direct Impact on GLPI

Key Takeaways:

• GLPI is not directly affected: The core GLPI codebase does not contain these security flaws.
• Your hosting servers are concerned: Because GLPI relies on PHP to run, any web server hosting a GLPI instance remains vulnerable until the server’s underlying PHP engine is patched — regardless of your GLPI version.
• Updating GLPI alone is not enough: You must update the PHP package installed on your host system or application container.

☁️ Are you using GLPI Network Cloud?

No action is required on your part.

Our Infrastructure and Cloud Security teams immediately deployed the necessary security patches across the entire platform upon disclosure. As of October 21, 2026, at 14:00 UTC, every GLPI Cloud server is running a patched, secure PHP version. Our internal security monitoring has detected no signs of exploitation or compromise.

🏢 Self-Hosting GLPI (On-Premises)?

Please follow these remediation steps as soon as possible to safeguard your web servers:

1. Check your web server’s active PHP version:Inside GLPI, navigate to Setup > General > System.(Note: The command-line interface command php -v checks the CLI version, which may differ from the PHP engine utilized by your web server or PHP-FPM service).
2. Apply the PHP update based on your environment:
   • Official Source Packages: Refer to the official PHP.net announcement.
   • Linux Distribution Packages (Debian, Ubuntu, Red Hat, etc.): Follow your distribution's security advisories, as security fixes are often backported without incrementing the primary version number.
   • Containers and Managed Hosting: Deploy updated base images or follow your provider’s security instructions.
3. Restart your web services:Restart your web server (Apache, Nginx) or PHP-FPM pool manager to load the patched PHP binaries into memory.
4. Unsupported PHP Versions (End-of-Life):Legacy PHP versions will not receive vendor security patches. Review the list of supported PHP versions. Before upgrading your PHP runtime to a newer major release, verify system requirements against the GLPI Documentation.

⚠️ Workarounds & compromise indicators

If you cannot immediately deploy the PHP security update:

• Rely exclusively on official security advisories (from PHP.net, your Linux distribution maintainers, or hosting provider) for valid mitigation strategies.
• Monitor server logs for potential exploitation indicators provided by your SecOps team or security vendors.
• If you suspect your host environment has been compromised, isolate the instance and contact your internal IT security team immediately.

Using Official GLPI Docker Images

We have rebuilt the official GLPI Docker images for versions main, 12, 11, and 10: they now include a patched version of PHP.

To apply this update, pull the new image and recreate your containers—for example, using docker compose pull followed by docker compose up -d. Simply restarting an existing container is not enough: it will continue using the old image. Your data remains safe if stored in volumes, as specified in the recommended setup.

📢 Next steps & resources

• Read the Official PHP Security Announcement
• Review the GLPI Official Installation & Prerequisites Guide
• Explore GLPI Network Cloud Services for fully managed, hassle-free ITSM security.