On October 21, 2026, the PHP project released fixes for two critical security flaws in PHP, the programming language behind a large share of the web. Together the flaws are known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. Both let an attacker run their own code on a web server without logging in, which can mean taking control of the server. Each is rated 9.2 out of 10 for severity.
If your business has a website, an online store, a customer portal, or an internal web tool, there is a good chance PHP is somewhere underneath it. The fix is a routine update, and the sooner it is applied, the better.
The short version: find out where PHP runs in your business, update it to a fixed version, and restart it. If something cannot be updated right away, limit who can reach it from the internet until it can.
What PHP2Shell is
Both flaws sit in parts of PHP that nearly every web request touches: how it manages memory and how it recovers from errors. One is triggered when PHP runs out of memory partway through setting up a request. The other comes from leftover data from one request that a later request can act on. You do not need the technical details to act on this. What matters is that an attacker does not need a password, and on some setups a single request is enough, before the website's own code even runs.
Who is at risk
According to PHP and CERT-EU, every PHP installation that serves web requests is in scope, whether it runs under PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed or FrankenPHP. PHP considers Apache with mod_php the highest-risk setup. In everyday terms, that includes:
- WordPress and other websites built on PHP
- Web hosting control panels
- Older or custom web applications and internal tools
- Some commercial products and appliances that use PHP behind their web admin pages, even when PHP is not obvious
That last group is the easiest to miss. CISA notes that PHP is often a component of other software, so it may not show up on a simple list of servers.
How to fix it
Update PHP to the fixed release for the version you run: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Then restart every PHP process so the fix takes effect. Linux distributions received the patch ahead of time, so for most servers the fix arrives as a normal package update. PHP states that no configuration change fully mitigates these flaws, so the update is the real fix.
PHP 8.1 and older. These versions no longer get official releases from the PHP project. Some Linux distributions and long-term support vendors offer backported fixes, and PHP has published minimal source backports for 7.4, 8.0 and 8.1. Versions older than that have no fix and need to be upgraded. CISA advises that systems which cannot be updated right away, or that still run PHP 8.1 or earlier, be taken offline until they can be patched or upgraded.
A stopgap, not a fix. CISA notes that a web application firewall may provide some protection until systems are updated. Treat it as a way to buy a little time, not a reason to wait.
Why this week matters
CISA urges organizations to patch immediately and to prioritize internet-facing systems. Security firm watchTowr reports that it has observed exploitation in the wild since October 21. When a flaw is this severe and proof-of-concept code is circulating, the window between the fix and active attacks is usually short.
Questions to ask this week
If someone else runs your website or servers, these questions will get you a clear answer quickly:
- Which of our websites, portals and internal tools run on PHP?
- What PHP version does each one run, and has it been updated to a fixed release?
- Do any of our devices or appliances, such as firewalls, phone systems or camera servers, use PHP for their admin pages, and has the vendor released an update?
- Is anything still on PHP 8.1 or older, and what is the plan for it?
- Were the PHP processes restarted after the update?
If you run WordPress yourself, the dashboard shows the PHP version under Tools, then Site Health, then Info, in the Server section. Your hosting provider can tell you whether its servers have been updated.
Sources
Not sure whether your website, hosting panel or office systems run PHP? We can check which of your sites and systems run vulnerable PHP and help you get them patched. Call 713.980.2000 or send us a note.
Let's Talk →