PHP2Shell: Two Critical Vulnerabilities
PHP2Shell: Two Critical Vulnerabilities in PHP, Administrators Must Update Servers Immediately
Published on October 21, 2026 | IT Security
Two critical vulnerabilities affecting the PHP programming language are currently the subject of a global cybersecurity alert. Identified as CVE-2026-109618 and CVE-2026-109619, they could allow an attacker to execute arbitrary code remotely on a vulnerable server without prior authentication.
A major threat to web servers.
Grouped under the name PHP2Shell, these vulnerabilities affect several PHP versions used to power websites, applications, and online services.
Exploiting these flaws could allow an attacker to compromise a server and potentially gain access to sensitive files or data. Internet-facing
PHP installations are particularly at risk, especially those using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed.
Which versions are affected?
The PHP development team released security updates on October 21, 2026, to address these two vulnerabilities.
The patched versions are as follows:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Earlier versions of the affected branches must be updated. Users running PHP 8.1 or older should check with their vendor to see if a patch is available or upgrade to a supported version.
What should administrators do?
Server administrators and website managers are advised to:
- Check the PHP version used by their servers and hosting environments.
- Immediately install a patched version compatible with their environment.
- Restart affected services if necessary to ensure the new version is properly loaded.
- Review web server logs and unusual processes to detect potential signs of compromise.
- Also check containers, applications, and third-party products that bundle their own PHP version.
An operating system update does not necessarily guarantee that all PHP environments are patched: some hosting setups and containers use independent versions.
PHP 8.2.35: A Patch to Install Without Delay
PHP version 8.2.35 patches both vulnerabilities for the PHP 8.2 branch. However, this branch is set to reach End-of-Life on December 31, 2026. Administrators should therefore plan their migration to a newer, supported branch.
No workaround can fully replace installing the official patch.
Conclusion
PHP2Shell: Two Critical Vulnerabilities: The PHP2Shell alert highlights the importance of keeping web software components up to date. Administrators should prioritize internet-facing servers and promptly verify that the patched versions are actively running.