Kudo Communication to Supply TuxCare PHP Patches for PHP2Shell Flaws
The Korean distributor is offering TuxCare's ELS for Runtimes to companies on end-of-life PHP, including fixes for CVE-2026-109618 and CVE-2026-109619.
Kudo Communication announced on October 27, 2026, that it is supplying TuxCare's ELS for Runtimes security support for companies in Korea running end-of-life PHP, according to dailysecu.com. The offering includes patches for the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
TuxCare said the packages carry security fixes for affected PHP environments. The approach relies on backporting security fixes into existing version branches, so companies can respond to the flaws without immediately upgrading PHP.
The announcement comes as PHP administrators in Korea face a moving target. KISA said on the 24th that a new vulnerability, CVE-2026-115560, can occur in certain session configuration combinations and is not fixed by the security update distributed on the 21st.
As a temporary measure, KISA advised disabling file upload progress tracking and restarting all PHP worker processes.
The PHP2Shell vulnerability, which could lead to remote code execution, was recently disclosed in PHP, and further new vulnerabilities were subsequently identified. Kudo Communication is TuxCare's exclusive domestic distributor in Korea.
Quick answers
Which PHP vulnerabilities does TuxCare's ELS for Runtimes address?
TuxCare says it provides packages with security fixes for the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Does the October 21 PHP security update fix CVE-2026-115560?
No. KISA said CVE-2026-115560 is not fixed by the security update distributed on the 21st.
What temporary measure did KISA recommend?
KISA advised disabling file upload progress tracking and restarting all PHP worker processes.