PHP2Shell Vulnerabilities CVE-2026-109618 and CVE-2026-109619 to Be Addressed in 7.2.1 Security Build

On October 21, 2026 the PHP project disclosed two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), publicly referred to as PHP2Shell. Both can allow unauthenticated remote code execution on web servers running affected PHP versions. Metric Insights uses PHP in its web tier, so Metric Insights instances are affected.  Both an interim mitigation and the complete fix are now available, as described below.

NOTE: Metric Insights environments that are publicly available are at most risk.

Status

  • Metric Insights 7.2.1: a security build containing the patched PHP (8.4.27) is now available. The upgrade procedure is described below.
  • Metric Insights 7.2.2 Beta 1 and later will include the patched PHP.
  • Older builds: the complete fix requires the patched PHP, which ships in the 7.2.1 security build and in 7.2.2 Beta 1 and later. A temporary hardening patch is available for affected older versions as an interim mitigation.

How to Remediate

Two options are available: a temporary patch that hardens PHP as an interim mitigation, and an upgrade to the 7.2.1 Security Build that fully remediates the vulnerabilities.

Apply the Temporary Patch (Mitigation Only)

A patch that applies PHP hardening settings is available for affected Metric Insights versions, including 7.0.2a, 7.1.0, 7.1.1, 7.1.2a, 7.2.0a, 7.2.1, and 7.2.2 Beta 1:

  • CVE-2026-109619 can be mitigated, but not fixed, by disabling the PHP session upload-progress feature. Metric Insights does not use this feature, so there is no functional impact.
    • The server is also configured to accept only session IDs that already exist on the server.
  • CVE-2026-109618 can be partially mitigated, but not fixed, through a PHP configuration change.

Contact the Metric Insights Support team to request and apply the patch for your specific version.

This patch is hardening and mitigation only, not a complete fix. It reduces exposure by preventing the vulnerabilities from being exploited, but it does not patch the underlying PHP vulnerability and does not make an instance safe.

Upgrade to the 7.2.1 Security Build (Complete Fix)

The 7.2.1 Security Build is the complete remediation: it replaces PHP with the patched version (8.4.27). For the full procedure, including enabling security images, pulling and recreating containers, and verifying the result in Status Monitor, see Deploying Metric Insights Security Builds.

Metric Insights 7.2.2 Beta 1 and later already ship with the patched PHP by default, so this upgrade step is specifically for customers who want the fix without moving off the 7.2.1 release line.

References