On 22 October 2026, tiger.PHARMA updated the PHP runtime across all PHP-based systems operated by us. This includes our shop systems, the relevant components of pharmadata360.eu, and systems hosting customer applications. The action responded to the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell.
What is PHP2Shell?
PHP2Shell is the name used for two critical flaws in PHP core. Official advisories state that, under certain conditions, they can enable unauthenticated remote code execution on affected servers. Both carry a CVSS 4.0 score of 9.2. The issue can therefore affect the technical foundation of websites, online shops, content management systems and custom web applications.
Systems included in the tiger.PHARMA update
- PHP-based components of our shop infrastructure,
- relevant PHP components of pharmadata360.eu,
- systems hosting customer applications,
- dependent runtime services required for reliable operation.
The description communicates the maintenance scope without disclosing internal versions, server details or security-sensitive configurations.
What the update achieves
Installing corrected packages from the responsible vendor or distributor closes the known PHP2Shell vulnerabilities in the updated runtime. Operators must also restart relevant workers and verify applications, interfaces and background processes.
Security remains an ongoing process. Access control, encryption, logging, backups, recovery, dependency management and new security advisories require continuous attention. Learn more on the tiger.PHARMA homepage and the pharmadata360.eu homepage.
FAQ
Which CVEs are known as PHP2Shell?
CVE-2026-109618 and CVE-2026-109619.
Did tiger.PHARMA update its PHP systems?
Yes. The PHP runtimes of the systems operated by tiger.PHARMA were updated on 22 October 2026, including shop systems, relevant pharmadata360.eu components and systems hosting customer applications.
Does the update make every system completely secure?
It closes the known PHP2Shell vulnerabilities in the updated components. Complete security also depends on ongoing maintenance and layered technical and organisational controls.