PHP2Shell: two critical PHP flaws let attackers take over web servers. Update now

On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities nicknamed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. Both can allow an attacker to run code on a web server with a crafted HTTP request, without any login. PHP rates each of them 9.2 out of 10 on the CVSS v4.0 scale and says updating is the only safe option.

A disclosure that leaked early

The fixes were meant to arrive under a coordinated disclosure. Instead, a post on the Hacker News forum on 20 October revealed the CVE numbers and claimed that versions going back to PHP 5 were affected, before any patch existed. The PHP security team responded by confirming it was working on fixes and reserving the right to release early, then published them on 21 October at 14:00 UTC. The UK’s National Cyber Security Centre and CERT-EU both issued advisories urging organisations to prepare for immediate patching.

Speed matters here. Infosecurity Magazine has since reported that Amazon detected an exploitation attempt days before the official disclosure, and threat intelligence firm SOCRadar says it has found PHP2Shell exploit tooling.

Which versions are fixed

Every release below those numbers on each branch is affected. If you are still on PHP 8.1 or earlier, this is the moment to plan a move to 8.4 or 8.5 rather than relying on backports.

Why this one matters so much

According to W3Techs, PHP runs around 70% of websites whose server-side language is known. That includes WordPress, Drupal, Joomla and Magento, and countless custom sites. The flaws are in PHP itself, so keeping your CMS and plugins up to date does not protect you on its own: the PHP interpreter on the server must be updated.

What to do

If you run your own server or VPS

• Check your version with php -v on the command line, and remember that the web server may use a different PHP-FPM version from the CLI.
• Update through your distribution’s packages or your PHP repository. Distributions often backport fixes without changing the upstream version number, so check your distribution’s security advisory for the patched package version.
• Restart PHP-FPM (or Apache with mod_php) afterwards. Until the process restarts, the old, vulnerable code is still running.
• Patch internet-facing machines first, then everything else.

If your website is on shared or managed hosting

• Look in your control panel for the PHP version selector and make sure you are on a supported branch.
• Ask your host whether the PHP2Shell patches have been applied. Reputable hosts will have done so within hours, but it costs nothing to check.
• If your site is pinned to an end-of-life PHP version for compatibility reasons, treat this as the push to update the site.

Some hosting providers have published temporary php.ini settings that make the known attack paths harder. They are a stop-gap at best: PHP states in its advisories that there is no complete configuration-only mitigation.

Sources

• Infosecurity Magazine: Critical PHP vulnerabilities leaked ahead of scheduled security patches (21 October 2026)
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched (21 October 2026)
• Greenbone: PHP2Shell remote code execution, affected versions and support status
• SOCRadar: PHP2Shell affected versions and fix
• National Cyber Security Centre: Critical security issue affecting PHP
• W3Techs: usage of server-side programming languages