PHP2Shell 漏洞：对 MapStore、GeoServer 和 GeoNode 用户意味着什么
2026年10月21日，PHP 项目发布了针对两个严重漏洞的修复程序，编号为 CVE-2026-109618 和 CVE-2026-109619，统称为 PHP2Shell。这些漏洞允许攻击者在运行 PHP 的 Web 服务器上未经认证执行远程代码，且在公开披露之前就已观察到利用尝试。英国国家网络安全中心（NCSC）已发出警报，要求各组织查找并修补所有 PHP 安装，对于无法修复的应离线处理。 消息发布后，许多使用 GeoSolutions 开源产品的组织纷纷询问自身是否受到影响。简短的回答是：不受影响，因为 MapStore、GeoServer 和 GeoNode 均不使用 PHP。官方发行版和 Docker 镜像不包含也不依赖 PHP，因此 PHP2Shell 与这些产品的发布版本无关。 然而，产品本身不受影响，并不意味着您的部署环境绝对安全。每个安装实例的配置各不相同，我们通常无法了解您的具体设置。因此，建议您全面检查地图服务周边的整个技术栈，包括 Web 服务器、反向代理、数据库以及任何自定义集成组件，确保没有遗漏可能引入 PHP 的环节。
GeoSolutions 是 MapStore 开发的领导者，并参与 GeoNode 和 GeoServer 项目的安全工作。当问题报告后，我们协助分析、准备和测试修复程序，并与社区其他成员协调发布。我们已通过 ISO 27001 认证，始终致力于在各项工作中加强安全。 在生产环境中运行开源软件并不意味着孤军奋战。通过我们的企业支持服务、企业订阅服务和专业培训服务，我们帮助组织构建安全、稳定的地理空间解决方案。如果您对 MapStore、GeoServer 或 GeoNode 的安装有任何疑问，欢迎联系 sales@geosolutionsgroup.com。 需要说明的是，本文仅针对已发布产品提供一般性指导，并非对任何特定安装实例的评估。如需了解 PHP2Shell 漏洞的完整技术细节和修复建议，请点击原文链接查看。
编译自 Planet OSGeo，原文链接
原文摘要
PHP2Shell: what it means for MapStore, GeoServer and GeoNode users
On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. They allow unauthenticated remote code execution on web servers running PHP. Exploitation attempts were observed even before public disclosure. The UK NCSC has issued an alert asking organisations to find and patch every PHP installation, and to take offline what they cannot fix. Since then we have been receiving questions from organisations running our open source products. Here is the short answer, and what we suggest you check. No since none of them uses PHP. The official distributions and Docker images do not include or depend on PHP. PHP2Shell is not relevant to , or as released.MapStoreGeoServerGeoNode The products are not affected, but your deployment might still be exposed. Every installation is different, and we usually have no visibility on how yours was set up. So take a look at the whole stack around your maps. GeoSolutions leads the development of MapStore and takes part in the security work of the GeoNode and GeoServer projects. When an issue is reported, we help analyse it, prepare and test the fixes, and coordinate the releases with the rest of the community. We are certified ISO 27001. We are doing our best to strengthen security in everything that we do. Running open source in production does not mean running it alone. With our , and we help organisations:Enterprise Support ServicesEnterprise Subscription ServicesProfessional Training Services Want to talk about your MapStore, GeoServer or GeoNode installation? Write to .sales@geosolutionsgroup.com This post is general guidance on the products as published. It is not an assessment of any specific installation. Are MapStore, GeoServer and GeoNode affected? Your installation is a different question Security is ongoing work for us How we can help Sources is a Java web application. Its frontend is JavaScript running in the browser.MapStore is a Java web