If your website or application runs on PHP, there is news you need to act on quickly. The PHP security team has released patches for two critical vulnerabilities known as PHP2Shell. Both score 9.2 out of 10 — critical severity.
What makes this serious: the flaws sit in the PHP core itself, not in WordPress, Laravel, or any other application layer. Even if your application code is clean, the server can still be attacked if the PHP runtime is unpatched.
What actually happened?
The related CVEs are CVE-2026-109618 and CVE-2026-109619. Both can allow an attacker to run code on the server without logging in. On some setups, especially Apache with mod_php, the attack can trigger before any application code runs.
One bug relates to how PHP handles out-of-memory situations while processing a request. The other involves internal state that can linger between requests on the same worker. Together they can be turned into remote code execution.
Details leaked before the official release window, and exploits are circulating. Some parties have reported exploitation attempts online.
Who is affected?
Almost every PHP installation that serves web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, and similar. Risk is reported highest for Apache with mod_php.
Because the flaw is in the PHP engine, popular applications such as WordPress, Drupal, Magento, Joomla, Laravel, and many others are exposed as long as their runtime remains unpatched.
Safe PHP versions
Official updates shipped on 21 October 2026. Patched versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older are end-of-life. The PHP project published limited source backports for 7.4, 8.0, and 8.1, but the main recommendation is to move to a supported branch. Some Linux distributions and LTS vendors have also shipped patched packages — check your provider or host.
What to do now
Priority one: update the PHP runtime to one of the safe versions above, then restart the service (php-fpm, apache, etc.). That is the only complete fix.
While waiting for the update, temporary mitigations (such as disabling session.upload_progress) can reduce risk, but they do not replace the patch. Do not rely on temporary measures for long.
If you use managed hosting or colocation, ask your provider whether PHP has already been updated. Well-managed infrastructure usually responds quickly to critical security patches like this.
The bottom line is simple: do not delay. This flaw sits in the foundation, not in the application layer. The sooner the runtime is updated, the smaller the chance the server becomes a target.
