Oracle Security Alert for CVE-2026-109618 and CVE-2026-109619

From the official statement:

CVE-2026-109619 (PHP2Shell) was released on October 25, 2026.

Oracle strongly recommends that customers follow the recommended actions noted in the Security Alert.

The Oracle Security Alert Advisory for CVE-2026-109618 & CVE-2026-109619 is available at:
https://www.oracle.com/security-alerts/alert-cve-2026-109618.html

Customers using customer-managed deployments running on-premises or on Oracle Cloud Infrastructure (OCI) are responsible for planning, testing, and applying security updates. Oracle strongly recommends applying security patches as soon as possible.

Customers using Oracle-managed cloud services continue to receive security updates automatically as part of the service.

Additional Oracle security resources:
https://blogs.oracle.com/security/
https://www.oracle.com/security-alerts/
https://www.oracle.com/security-alerts/#cloud
https://www.oracle.com/corporate/security-practices/assurance/vulnerability/security-fixing.html