PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Status: Advisory Affected products: TrueNAS CE/Enterprise (SCALE): Not Affected. TrueNAS CORE: Not Affected. TrueCommand: Not Affected. TrueNAS Connect: Not Affected. TrueNAS app catalog: certain PHP-based applications are affected — see below. Severity (TrueNAS-adjusted): Not applicable to the TrueNAS platform; up to Critical for affected PHP-based applications a user has chosen to install. Upstream severity: Critical — unauthenticated remote code execution in the PHP engine (CVSS up to 9.2) External references: PHP project security release (21 October 2026); Wiz Research “PHP2Shell”

“PHP2Shell” refers to a set of memory-safety vulnerabilities in the core PHP engine, grouped under CVE-2026-109618 and CVE-2026-109619 and publicly disclosed on 21 October 2026. The flaws stem from how PHP handles fatal and out-of-memory errors: a request that aborts can leave corrupted internal state behind, which a later request handled by the same persistent worker can reuse, leading to process-memory disclosure or memory corruption. Successful exploitation can allow an unauthenticated, remote attacker to execute code or read sensitive process memory (session data, tokens, keys). The vulnerabilities are in PHP itself and are independent of the application running on top of it; every PHP release since 5.4 is affected by at least one of them. The PHP project released fixes for supported PHP branches on 21 October 2026.

The TrueNAS platform does not ship or use PHP. TrueNAS CE/Enterprise (SCALE) and TrueNAS CORE do not include a PHP interpreter; the TrueNAS middleware is implemented in Python and the web interface is a browser application. There is no PHP engine in the operating system, middleware, or web UI for these vulnerabilities to affect. TrueNAS CE/Enterprise and TrueNAS CORE are Not Affected.

TrueCommand is Not Affected. TrueCommand is implemented in Go and JavaScript and does not include PHP.

TrueNAS Connect is Not Affected. The TrueNAS Connect services are implemented in Go, with Python and JavaScript components, and do not include PHP.

No action is required on the TrueNAS platform itself.

The only exposure within the TrueNAS ecosystem is third-party applications that are built on PHP and run as containerized apps, where the PHP runtime is bundled inside the application’s own container image. These applications are optional and are only present if a user has installed them. Notable PHP-based applications include Nextcloud and other content-management and web applications (for example WordPress and similar).

Because the PHP runtime lives inside each application’s container image — not in the TrueNAS host — the vulnerable component is the application image, and the fix is an updated image containing a patched PHP. Updating the TrueNAS system does not change an application’s bundled PHP.

• TrueNAS platform: no action required (Not Affected).
• Nextcloud (maintained by iX): iX is publishing an updated Nextcloud application image built on a patched PHP. Update the Nextcloud app to the latest catalog version once it is available.
• Other PHP-based applications (maintained upstream): these are remediated when their upstream maintainers publish an updated image built on a patched PHP; the TrueNAS catalog is updated to the new image as those become available. Update the affected app to its latest version once released.
• General guidance: keep installed applications updated, and avoid exposing application web interfaces directly to untrusted networks. An application still running a vulnerable, unpatched PHP version remains at risk until its image is updated; if an update is not yet available for an exposed application, consider restricting access to it in the interim.

TrueNAS products are not affected and require no fix. For affected PHP-based applications, remediation is delivered through updated application images; iX is updating the images it maintains, and will advance catalog entries for upstream-maintained PHP applications as patched images are published. This advisory will be updated as those application updates become available.