Coolify and PHP2Shell

The statement

Read the statement on github.com, dated Oct 21, 2026. Source type: official page.

Notes

Pinned issue Security: update Coolify now for PHP2Shell (CVE-2026-109618, CVE-2026-109619) by maintainer peaklabs-dev on the project's official GitHub repository: the flaws affect every Coolify v4 version. Update your instance immediately. and We backported the fix to every v4 line, so you can update without leaving your minior version. quoted from the issue URL. v4.4 users update from the dashboard; v4.0 to v4.3 users run the patch script, which restarts only the Coolify container; beta or older installs reinstall v4.0.1 then update to v4.4.7. Temporary PHP mitigations only if updating is impossible; also update Sentinel, cloudflared 2026.10.3 and own Node.js runtimes.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

The badge for Coolify reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.

Coolify's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Coolify and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.