Release notes

# PHP2Shell detection now live in UpGuard

Mark Barber October 21, 2026

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP vulnerabilities disclosed this week. They let an unauthenticated attacker run code on a vulnerable web server. The real concern is how far back they go. Every version from PHP 5.4.0, released in 2012, up to 8.2.34 is affected, along with 8.3.0 to 8.3.35, 8.4.0 to 8.4.26 and 8.5.0 to 8.5.11. Fixes are available in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 5.x, 7.x, 8.0 and 8.1 are end-of-life and won’t get a fix, so anything still running those versions needs a major upgrade. Workarounds are circulating, however official advice from PHP is that upgrading is the only reliable fix.

UpGuard has added both CVEs as verified vulnerabilities in Breach Risk and Vendor Risk. Detection is based on the PHP version, so any domain or IP running an affected version gets flagged. Security teams can see where their organization and their vendors are potentially exposed and prioritize patching and remediation requests.

[View all release notes](/releases)

## UpGuard Release Notes

Learn about new features, changes, and improvements to UpGuard.

### Close related exposed credential threats in one step

Mark Barber October 20, 2026

[Read more](/releases/close-related-exposed-credential-threats-in-one-step)

### Security Profile citations now include source control references

Mark Barber October 6, 2026

[Read more](/releases/security-profile-citations-now-include-source-control-references)

### Threat Posture: an executive view of external threat activity

Mark Barber September 22, 2026

[Read more](/releases/threat-posture-an-executive-view-of-external-threat-activity)

### Brand impersonation detection across mobile app stores

Mark Barber September 9, 2026

[Read more](/releases/brand-impersonation-detection-across-mobile-app-stores)

### Clearer citations and timeline for Security Profile checks

Mark Barber August 26, 2026

[Read more](/releases/clearer-citations-and-timeline-for-security-profile-checks)

### Subprocessors in Trust Center

Mark Barber August 12, 2026

[Read more](/releases/subprocessors-in-trust-center)

### Cloud and core infrastructure frameworks in Security Profile

Mark Barber July 29, 2026

[Read more](/releases/cloud-and-core-infrastructure-frameworks-in-security-profile)

### Complete questionnaires without closing remediation

Mark Barber July 15, 2026

[Read more](/releases/complete-questionnaires-without-closing-remediation)

[View all release notes](/releases)

### See UpGuard In Action

Book a free, personalized onboarding call with one of our cybersecurity experts.

[Free trial](https://www.upguard.com/demo)

[Get a demo](https://www.upguard.com/contact-sales)

Free instant security score

## How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.

* Instant insights you can act on immediately
* Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities

[Free score](https://www.upguard.com/instant-security-score?)