Security Advisory — SA-2026-001

PHP2Shell Remote Code Execution Vulnerability

CVE-2026-109618  CVE-2026-109619  CVSS 9.2 — Critical

Published: October 22, 2026  ·  Affects: Xeams Virtual Appliance (Rainloop / PHP component)  ·  Xeams core: Not affected

About the PHP2Shell Vulnerability

PHP2Shell (disclosed October 20, 2026) refers to two critical remote code execution vulnerabilities in the PHP runtime engine:

  • CVE-2026-109618 — An out-of-memory condition that allows an attacker to corrupt heap memory and execute arbitrary code.
  • CVE-2026-109619 — Exploitation of stale global state within the PHP interpreter, also leading to arbitrary code execution.

Both flaws affect PHP versions 5.4 through 8.5, a range spanning releases dating back to 2012. The PHP Security Team rates the combined CVSS score at 9.2; independent security firm watchTowr assigns it a perfect 10.0. Exploitation was detected in the wild prior to public disclosure.

Who Is Affected

You are affected if all three of the following are true:

  • You deployed the Xeams Virtual Appliance (not a standalone Xeams installer).
  • The appliance was downloaded and set up before Rainloop was removed from the image.
  • Rainloop and its PHP dependency have not already been removed from that system.

To check whether Rainloop is present on your system, run the command in Step 1 below.

Remediation: Remove Rainloop and PHP

Follow these steps on the virtual appliance host. All commands require root or sudo access.

Step 1 — Check whether Rainloop is installed

Run the following command. If the directory does not exist, Rainloop was never installed or has already been removed. In that case, skip to Step 5 to verify PHP is also absent.

sudo ls -ld /var/www/rainloop
Step 2 — Back up Rainloop files Optional

If you need to preserve any Rainloop data or configuration before removal, create a backup first.

sudo mkdir -p /root/rainloop-backup
sudo cp -a /var/www/rainloop /root/rainloop-backup/
sudo cp -a /etc/nginx/conf.d/rainloop.conf \
  /etc/nginx/sites-available/rainloop.conf \
  /root/rainloop-backup/
Step 3 — Remove the Rainloop web root

Delete the Rainloop application directory and scan for any remaining references in your web server configuration.

sudo rm -rI /var/www/rainloop
sudo grep -Ril rainloop /etc/apache2 /etc/nginx 2>/dev/null
Step 4 — Remove Rainloop web server configuration

Remove the Nginx virtual host files for Rainloop. Omit any path that does not exist on your system.

sudo rm /etc/nginx/sites-enabled/rainloop.conf
sudo rm /etc/nginx/sites-available/rainloop.conf
sudo rm /etc/nginx/conf.d/rainloop.conf
Step 5 — List installed PHP packages

This command lists every PHP-related package currently installed. Review the output before proceeding.

dpkg -l | awk '/^ii/ && $2 ~ /^php/ {print $2}'
Step 6 — Stop and disable the PHP-FPM service

Stop the running PHP FastCGI Process Manager service and prevent it from restarting at boot.

sudo systemctl stop php7.4-fpm
sudo systemctl disable php7.4-fpm
Step 7 — Remove all PHP 7.4 packages

Purge PHP and all of its extension packages. This removes both the binaries and their configuration files.

sudo apt purge \
    php-common php7.4 php7.4-cli php7.4-common \
    php7.4-curl php7.4-fpm php7.4-json php7.4-opcache \
    php7.4-readline php7.4-xml

Confirming Successful Removal

Run each check below after completing the steps above. Every check should return no output or confirm removal.

What to check Command Expected result
No Rainloop files remain 
sudo find /var/www /var/lib /opt /etc /usr/share \
  -iname '*rainloop*' -print 2>/dev/null
 No output
No Rainloop web server config remains 
sudo grep -Ril rainloop \
  /etc/nginx /etc/apache2 2>/dev/null
 No output
Config files specifically removed 
for f in \
  /etc/nginx/conf.d/rainloop.conf \
  /etc/nginx/sites-enabled/rainloop.conf \
  /etc/nginx/sites-available/rainloop.conf; do
  sudo test -e "$f" && echo "STILL EXISTS: $f" \
    || echo "REMOVED: $f"
done
 All lines say REMOVED
No PHP packages installed 
dpkg -l | grep -E \
  '^(ii|rc).*(php[0-9.]|php-common|libapache2-mod-php)'
 No output
PHP binary not present 
php -v
 Command not found
Port 5678 no longer listening 
sudo ss -lntup | grep ':5678'
 No output

Additional Resources