PHP php2shell RCE on SAP BTP: CVE-2026-109618 · CVE-2026-109619 · CVSS 3.0 9.8 · SAP Note 3846599
SAP released Note 3846599 out of band on 5 November for the php2shell chain. It consists of two memory safety bugs in the PHP request lifecycle, CVE-2026-109618 and CVE-2026-109619. Combined, they allow unauthenticated remote code execution. Every PHP 8.x line before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is affected. On SAP BTP, this concerns PHP applications, including those around SAP Business AI Platform. SAP rates the PHP php2shell RCE on SAP BTP at CVSS 9.8, HotNews. In this post, we cover exposure, the fix and what to check.
PHP php2shell RCE on SAP BTP: Cloud Foundry
SAP rolled out PHP buildpack 5.1.4 on 21 October with the fixed PHP versions. However, running applications do not pick it up by themselves. So run cf restage for each PHP app, with –strategy rolling for zero downtime. Docker-based apps, in contrast, need a rebuilt image with a fixed PHP version to close the PHP php2shell RCE on SAP BTP.
Kyma
PHP workloads in Kyma need the same image rebuild. After that, push the image to the registry and roll out the workload, so that Kubernetes recreates the pods. For example, use kubectl rollout restart. Pushing an image alone, however, does not restart anything, so this issue stays open until the rollout.
What to check
First, list every PHP app across all subaccounts and spaces. Then check the PHP version each one actually runs. There is no fully effective workaround, so an app that nobody restaged is still exposed to the PHP php2shell RCE on SAP BTP. FAQ: 3848007.
Why restaging is easy to miss
Buildpack updates happen in the background, so teams often assume their apps are already safe. In reality, each app keeps its old droplet until someone restages it. Therefore, add a restage step to your runbook for every runtime HotNews, not only for the PHP php2shell RCE on SAP BTP.
PHP php2shell RCE on SAP BTP: advisory details
Component: BC-CP-CF-BLDP
SAP priority: HotNews
First release: 05.11.2026
Reviewed release: 5 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: SAP Security Note 3846599 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
