Help & Documentation
Open Support Ticket

PHP2Shell Vulnerabilities CVE-2026-109618 and CVE-2026-109619 to Be Addressed in 7.2.1 Security Build

On October 21, 2026 the PHP project disclosed two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), publicly referred to as PHP2Shell. Both can allow unauthenticated remote code execution on web servers running affected PHP versions. Metric Insights uses PHP in its web tier, so Metric Insights instances are affected. We are aware of these vulnerabilities and are actively working on the fix.

NOTE: Metric Insights environments that are publicly available are at most risk.

What we are doing:

  • Metric Insights 7.2.1: a security build containing the patched PHP (8.4.27) is being prepared and will be available within the next few hours. We will announce it separately, together with the upgrade instructions.
  • Metric Insights 7.2.2 and later will include the patched PHP.
  • Older builds: a full fix is not available yet. We are working on a permanent and reliable solution for these versions and will post an update as soon as it is ready.

What you can do now

For older versions, and for 7.2.1 until you install the security build, partial mitigations are available based on the instructions in the PHP advisories:

  • CVE-2026-109619 can be mitigated, but not fixed, by disabling the PHP session upload-progress feature (session.upload_progress.enabled = 0). Metric Insights does not use this feature, so there is no functional impact.
    • To ensure session IDs actually exist on the server, session.use_strict_mode On is also being set
  • CVE-2026-109618 can be partially mitigated, but not fixed, by removing the per-request PHP memory limit (memory_limit = -1). 

These settings reduce exposure by preventing the vulnerabilities from being exploited, but they do not make an instance safe. Installing the security build with the new updated version of PHP is the only complete remediation. Our Support team can provide the exact steps for your deployment, including both mitigation steps in the interim (manual PHP configuration changes or a patch), and if possible, a permanent solution via upgrade.

References:

We will update this notice as the security build and the solution for older versions become available.