PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP that enable remote code execution (RCE). Their existence was publicly disclosed on 20 October 2026. Emergency patches for PHP 8.2, 8.3, 8.4 and 8.5, along with full vulnerability details, were released on 21 October 2026.
Is Foldr affected by PHP2Shell?
Yes. All versions of Foldr Server (v4 through v11 prior to 11.2.5.4) are affected.
Our response
We released Foldr Server 11.2.5.4 on 21 October 2026. This update upgrades the server’s PHP installation to the patched versions.
Running 11.2.5.4?
No further action is required. Your server is protected.
Foldr v10 – How to apply the patch
Foldr v10 can upgrade directly to 11.2.5.4 using the built-in updater in Foldr Settings.
Foldr v9 or earlier – How to apply the patch
Foldr v9 runs on a different operating system from v10 and v11, so an in-place upgrade is not possible. A migration pack to move from v9 to v11 is available from Foldr Support.