Statement on PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and Scanii
Summary
Scanii is not affected by CVE-2026-109618 or CVE-2026-109619. Our services are written primarily in Java and Go and do not run PHP. Our PHP client library, scanii-php , is not vulnerable and does not need an update. If you call Scanii from a PHP web application, update your PHP runtime; the SDK works unchanged on patched releases.
About the vulnerabilities
On October 21, 2026, the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated remote code execution bugs, nicknamed php2shell. Both are memory-safety bugs in the PHP interpreter's request handling and are triggered by a crafted HTTP request before application code runs.
| CVE | Advisory | Issue |
|---|---|---|
| CVE-2026-109618 | GHSA-w8hw-w9fx-j79w | Out-of-memory handling leaves request data partially initialized; cleanup treats it as valid |
| CVE-2026-109619 | GHSA-6wmf-4rv5-p3rp | Request state survives after its memory is freed and a later request on the same worker reuses it |
Any PHP installation that serves web requests is exposed: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Exploitation in the wild has been reported. PHP processes that only make outbound calls, such as CLI scripts and queue workers, are not reachable through this attack.
Impact on Scanii
None. The Scanii API, scanning pipeline and customer portal are built primarily in Java and Go. No Scanii system runs a PHP runtime, so there was no exposure and no action is required on our side.
Impact on scanii-php
scanii-php is a thin HTTP client over ext-curl and ext-json with no runtime dependencies. It only makes outbound requests to the Scanii API and never handles inbound web requests, so these CVEs don't apply to it. No SDK release is required.
The SDK can't protect the PHP runtime it runs inside. If your application serves web traffic through PHP, you're exposed through your own PHP installation regardless of which libraries you use.
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart all workers. The SDK requires PHP 8.4 or newer and runs unchanged on patched releases.
- If you can't update yet, apply PHP's interim mitigations in
php.inior your FPM pool config (notini_set()or.user.ini):session.upload_progress.enabled=0,memory_limit=-1asphp_admin_value, and a tightpost_max_size. On PHP 8.5, also setfatal_error_backtraces=0. - If you accept file uploads before sending them to Scanii,
post_max_sizenow caps what you accept. Size it to your largest expected file, or usefetchso Scanii retrieves content from a URL instead.
Mitigations are temporary. Updating is the only complete fix.