PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026
Description
Two critical remote code execution vulnerabilities, collectively referred to as PHP2Shell, were disclosed in PHP on October 21, 2026. The Okta Access Gateway includes a PHP runtime component affected by these vulnerabilities. The Okta Access Gateway’s default configuration mitigates known exploitation of these vulnerabilities. Okta recommends upgrading to the fixed version 2026.44.0.
Affected product and versions
Customers using Okta Access Gateway appliance versions running PHP 8.3.x prior to 8.3.36 are affected, which includes appliance versions prior to 2026.44.0.
Resolution
The vulnerabilities are present in PHP versions 8.3.x prior to 8.3.36, as included in the Okta Access Gateway versions prior to 2026.44.0. The vulnerabilities are resolved in Okta Access Gateway appliance version 2026.44.0, which includes PHP 8.3.36.