Security

PHP2Shell: what it means for MapStore, GeoServer and GeoNode users

On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. They allow unauthenticated remote code execution on web servers running PHP. Exploitation attempts were observed even before public disclosure. The UK NCSC has issued an alert asking organisations to find and patch every PHP installation, and to take offline what they cannot fix. Since then we have been receiving questions from organisations running our open source products. Here is the short answer, and what we suggest you check. Are MapStore, GeoServer and GeoNode affected? No since none of them uses...

More