Sophos and PHP2Shell

The statement

Read the statement on www.sophos.com, dated 2026 Oct 21 (Updated 2026 Oct 22, Article Version 4). Source type: official page.

Notes

Advisory sophos-sa-20261021-php2shell Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619): No Sophos products are affected by these vulnerabilities. Mixed: the legacy Sophos-hosted MyUTM licensing portal for end-of-life SG UTM ran an affected PHP version; Sophos took the portal offline on October 21, 2026 and is updating it before restoring service. No evidence of exploitation found, log review ongoing. IPS signatures for Sophos Firewall and Endpoint released 22 Oct 2026; Firewall WAF has no specific protection. Guidance for customers' own PHP apps: Restart all PHP workers after any configuration change.; PHP 8.1 and earlier are end-of-life and remain vulnerable. All quotes from the statement URL.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

The badge for Sophos reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.

Sophos's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Sophos and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.