On October 21, 2026, PHP released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell". Their severity is rated 9.2 out of 10.
PHP2Shell allows an attacker to run code on your server remotely, without logging in or having an account on your website. A single crafted request can be enough.
What is PHP?
PHP is the language that runs on the server behind a large share of the web, including WordPress, Joomla, and Laravel sites. About 7 in 10 websites whose server-side language is known use it, including many government websites and public services.
When you open a page on a PHP website, the server runs PHP to build that page: it reads the database, checks your login, and sends you the result. Your browser never runs PHP. It only receives the finished page.
Since the vulnerabilities are in PHP itself, it doesn't matter how well your website, WordPress install, or plugins are maintained. If your server runs an affected PHP version, you're exposed. And attackers started trying before the fix was even out.
Who is affected?
Website owners. Your site is affected if it runs on an unpatched PHP version. That could include WordPress (plugins are also exposed), Joomla, Drupal, Magento, Laravel and custom PHP sites.
Visitors. Your device is not targeted. These flaws attack the server, not your browser. But if a website you use gets compromised, the information you gave it, like your email, address or order history, could be exposed.
PHP 8.1 and older. These versions are no longer supported and get no official update. Some providers ship their own fix, so assume you're vulnerable until yours confirms otherwise.
Check the following table to know if you're exposed:
| If you run | You are vulnerable if below | Update to |
|---|---|---|
| PHP 8.5 | 8.5.12 | 8.5.12 |
| PHP 8.4 | 8.4.27 | 8.4.27 |
| PHP 8.3 | 8.3.36 | 8.3.36 |
| PHP 8.2 | 8.2.35 | 8.2.35 |
| PHP 8.1 or older | All versions | No official update (see above) |
What happened?
On October 20, 2026, PHP announced an emergency security release for two critical remote code execution vulnerabilities, after details leaked online. The fixes were published the next day.
Since then, the following happened:
| Date (UTC) | What happened |
|---|---|
| Oct 20 | Details leak online. PHP announces an emergency release for the next day |
| Oct 21, 07:43 | Cloudflare reports the first attacks, before any patch exists |
| Oct 21, 12:55 | Japan's Prime Minister, Sanae Takaichi, asks website owners on X to check for PHP and consider going offline |
| Oct 21, 14:00 | PHP publishes the fixed versions |
| Oct 21, 14:19 | watchTowr reports exploitation attempts against both flaws |
| Oct 21 | The NSA, FBI, CISA, the UK's NCSC and CERT-EU urge immediate patching, and taking systems offline if not possible |
| Oct 21 | Government websites go offline as a precaution in the Netherlands, France, Germany, Belgium, Finland and Denmark |
| Oct 21 | In the Netherlands, this includes the national cyber security centre, the parliament, DigiD and the Port of Rotterdam |
| Oct 21 to 22 | Wikipedia, the Internet Archive, Asana and GOG take systems offline to patch |
Every shutdown reported so far was a precaution, not the result of a confirmed attack.
How bad is it?
If an attack succeeds, the attacker can run commands on the server with the same permissions as the website. Let's take an example.
You run an online store on a server that hasn't been updated. An attacker gets in through PHP2Shell. They can now:
- Read the site's configuration file, including the database password.
- Copy the customer database: names, emails, addresses, order history, password hashes.
- Change your pages to add malware or a fake payment form.
- Leave a backdoor to come back later, even after you patch.
Whether they can take over the entire machine depends on how the server is set up. For your website and its data, the damage is already done.
The good news: attack attempts are not the same as successful break-ins. As of October 22, there is no public, confirmed report of a server compromised through these flaws. However, around 1.57 million internet-facing servers were still reporting unpatched PHP versions. Once a patch is public, attackers study it and start scanning for servers that haven't updated.
What should you do today?
- Ask your hosting provider or developer two questions. Which PHP version does my website use? Has it been patched for CVE-2026-109618 and CVE-2026-109619? Ask about the CVEs specifically, because some Linux distributions patch PHP without changing its version number.
- Update and restart. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart the web server and PHP.
- Upgrade if you're on PHP 8.1 or older.
- Don't rely on workarounds. Temporary settings and firewall rules can block some attacks, but PHP is clear that only updating fixes the problem.
- Check for signs of a break-in. Look for unknown admin accounts, recently changed files, and unexpected PHP files in upload folders. If anything looks wrong, change your database password and every API key stored on the server.
Final thoughts
PHP2Shell is not an isolated case. In the last ten days alone:
- GitLab patched a flaw rated 10 out of 10 that allows code execution without logging in. A public exploit followed the next day.
- eMudhra, an Indian certificate authority, had eight of its keys cracked, which could let attackers issue fake HTTPS certificates. We covered it here.
- Plex servers were hacked to install crypto miners, one day after an exploit for older, already-fixed flaws went public.
- OpenCode, an AI coding tool, was hit by attackers who ran up charges on its users' AI accounts.
- PHP2Shell pushed governments and some of the most visited websites in the world offline.
PHP2Shell was found with the help of AI, and AI is also helping attackers turn published fixes into working exploits faster. The time between a patch and the first attack is now counted in hours, not weeks.
We expect this volume of attacks to become the norm. So be prepared:
- Know what you run. You can't patch a server you forgot exists.
- Patch fast. Treat critical fixes for anything exposed to the internet as urgent, not as part of next month's maintenance.
- Plan ahead. Decide now what you would take offline if a fix isn't available yet.
- Limit the damage. Keep backups, use unique passwords and two-factor authentication, and verify everything you sign.
Stay safe.
Sources
- PHP: Security advisory, critical remote code execution vulnerabilities (21 Oct 2026)
- PHP: Upcoming critical PHP security release (20 Oct 2026)
- GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- CISA: Critical vulnerabilities in PHP require immediate patching
- watchTowr: PHP2Shell exploitation report
- Sansec: PHP2Shell analysis
- SecurityWeek: PHP2Shell exploitation and exposure numbers
- CSA Singapore: Critical vulnerability in GitLab CE and EE
- The Hacker News: Hackers exploit Plex2Shell flaws to deploy crypto miners
- TechCrunch: Hackers hit AI coding tool OpenCode
- 404 Media: AI is changing everything about hacking
- W3Techs: Usage statistics of PHP