PHP2Shell Emergency Patches for Critical PHP Flaws

Tomáš Král

21 Oct 2026

Add Informer Tech
as a preferred source

PHP2Shell Emergency Patches for Critical PHP Flaws

PHP maintainers released unscheduled security updates for two critical vulnerabilities in the language’s core engine, collectively known as PHP2Shell. The flaws could allow an attacker without an account to run code on a web server.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Each has a CVSS v4.0 score of 9.2. Fixed releases include:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

The updates were released at about 14:00 UTC on October 21, one day after details emerged ahead of a planned October 22 disclosure.

PHP2Shell Affects the PHP Runtime

PHP2Shell is not limited to a specific application or plugin. The vulnerabilities are in the PHP runtime itself, which means updating an application such as WordPress does not update the PHP version running underneath it.

Wiz Research, one of the teams involved in finding the flaws, said PHP powers about 70% of websites worldwide. It also stated that every PHP version from the past decade, dating back to PHP 5.4, has at least one of the affected bugs.

The vulnerabilities affect several PHP deployment methods and environments:

PHP-FPM
Apache with mod_php
php-cgi
FrankenPHP
LiteSpeed

Why `mod_php` Carries the Highest Risk

The PHP team identified Apache installations using mod_php as the highest-risk configuration. A demonstrated exploit can be triggered through an unauthenticated request before any application code runs.

That matters because application-level protections may not get a chance to respond. The issue exists below the application layer, in the runtime that processes PHP code.

The flaws may also allow attackers to read worker memory. That memory could contain sensitive material such as:

Passwords
API keys
Certificates

Emergency Updates and Older PHP Versions

PHP versions 8.1 and earlier are no longer supported and will not receive official releases. Still, because of the severity of PHP2Shell, the PHP team published minimal source backports for PHP 7.4, 8.0, and 8.1.

Organizations using these older releases remain in a difficult position. The source backports provide a path for addressing the flaws, but they are not official releases for unsupported versions.

PHP core developer Gina Peter Banyard said the only mitigation is patching or upgrading PHP.

Government Agencies Take Websites Offline

Some government organizations took websites offline as a precaution while the situation unfolded.

Reuters reported that government agencies in the Netherlands and Finland removed websites from service. Cybersecurity agencies in Europe, Australia, Japan, and Britain advised PHP users to update immediately or take affected systems offline.

According to the BBC, the Dutch cybersecurity agency shut down its own website. The Tweede Kamer, the lower house of the Dutch parliament, and the National Institute for Public Health and the Environment also took websites offline.

Britain’s National Cyber Security Centre advised that organizations should consider taking systems offline when immediate remediation is not feasible.

Early Attack Activity Reported

Before the patches were released, Cloudflare CTO Dane Knecht said the company was seeing early attacks emerge. He described firewall rules as a “STOPGAP only.”

At the time of reporting, no successful breach had been confirmed. As of 11:26 UTC, watchTowr had not observed exploitation in the wild.

The situation still called for prompt action because the vulnerabilities were disclosed after details leaked before the planned release date.

AI-Assisted Discovery of PHP2Shell

Wiz, Calif, and OpenAI’s Codex Security team found the PHP2Shell vulnerabilities. The underlying code had reportedly been present in PHP for more than a decade.

Wiz compared PHP2Shell with Heartbleed and Log4Shell. The company said frontier AI models substantially reduced the barrier to turning a long-standing flaw into a working exploit.

That does not change the immediate response: affected PHP environments need patched or upgraded runtime versions.

FAQ

What are the PHP2Shell vulnerabilities?

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical PHP core-engine flaws. They may let an unauthenticated attacker run code on a web server.