PHP2Shell (CVE-2026-109618/109619): patched PHP runtimes available

Patched PHP runtimes are now available for ExeOutput for PHP 2025: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. They fix the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

What to do

1. Refreshed installer: download ExeOutput for PHP 2025.0 (build 25.0.1.0). If you install it over an existing ExeOutput 2025, run Web Update afterwards, because the installer removes the PHP 8.2–8.5 runtimes. Choose Check For Updates and install the PHP 8.2 / 8.3 / 8.4 / 8.5 packages you use.
2. Rebuild and redistribute your applications. The PHP runtime is embedded in each EXE, so already-distributed apps keep the old PHP until you rebuild them.

Until you upgrade to a fixed PHP runtime, if you use the External HTTP Server option, note that it listens on all IPv4 interfaces: block its port in the firewall, or leave it off if you don't need it.

Full details: PHP2Shell Security Update for ExeOutput for PHP 2025