Summary

On October 21st, 23rd, and 26th, 2026, the PHP development team published multiple security advisories addressing critical vulnerabilities, including CVE-2026-109618, CVE-2026-109619, CVE-2026-115560, and CVE-2026-111497.

Reference Links:

• • https://www.php.net/archive/2026.php#2026-10-21-5
  • https://www.php.net/archive/2026.php#2026-10-23-1
  • https://www.php.net/archive/2026.php#2026-10-26-1

CVE Identifiers

• CVE-2026-109618
• CVE-2026-109619
• CVE-2026-115560
• CVE-2026-111497

Vulnerability Overview
Atrust is aware of the "PHP2Shell" security issues, which comprise multiple critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560, and CVE-2026-111497). Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code on the affected systems.

Affected Product

• Product Name: ADM (Atrust Device Manager)

Remediation & Action Required
Please upgrade ADM to version 2.30.020 or later, which includes the necessary security patches to resolve these PHP vulnerabilities.