Two critical remote code execution flaws in PHP were patched in an emergency release on 21 October 2026. Here is who is affected and what to do today.
On 21 October 2026 the PHP security team shipped emergency patches for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and can lead to remote code execution on servers that run PHP to serve web pages.
The release was brought forward after details leaked publicly on 20 October, two days before the planned coordinated disclosure. That leak is what makes PHP2Shell urgent: attackers had a head start, and early exploitation attempts have already been reported.
Who is affected
Reporting so far says the flaws affect PHP installations that serve web requests, including:
- Apache with mod_php
- PHP-FPM and php-cgi
- FrankenPHP and LiteSpeed
The PHP team has said the risk is highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. Researchers have also shown remote code execution against WordPress, Drupal and Joomla sites.
What to do today
The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you run PHP anywhere, treat this as a same-day patch:
- Inventory every PHP installation, including staging servers, old microsites and container images.
- Patch internet-facing servers first, then internal ones.
- Rebuild and redeploy Docker images that bundle PHP rather than patching running containers.
- Check your hosting provider's status page if you are on shared or managed hosting.
- Review web server logs from 17 October onward for unusual requests or new files in upload and cache directories.
The bigger lesson
PHP still powers a very large share of the web, which is why a single flaw in the runtime can put millions of sites at risk at once. The sites that recover fastest are the ones that already know exactly where PHP is running and can patch it in hours, not weeks.
If you are not sure what is exposed, a focused vulnerability assessment can map every PHP endpoint, confirm patch levels and check for signs of compromise.
