PHP, the programming language behind a large share of the world’s websites, released emergency security updates on October 21, 2026, after two critical flaws were found that could allow attackers to run code on a server without logging in, according to the PHP project and cybersecurity coverage. Website owners were urged to update immediately.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, were rated 9.2 out of 10 on the CVSS severity scale, according to multiple security summaries. They affect PHP installations that handle web requests, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed.
The PHP team said mod_php was the highest-risk configuration, with a demonstrated attack before a website’s own application code began running, according to its advisory. It also said there was no complete workaround: updating is the only safe response.
Which versions fix the flaw
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP advisory and security reports. Linux distributions and hosting providers may distribute the fixes in packages with different version numbers, so owners were advised to check with their vendor or host rather than relying on the branch number alone.
PHP 8.2 receives the current fix but reaches end of life on December 31, 2026, according to security guidance. PHP 8.1 and earlier no longer receive regular updates from the PHP project, although the team published minimal source backports for some older branches for people who build from source.
Updating a website application alone does not fix the problem, according to security experts. WordPress, Drupal, Joomla, Magento and Laravel sites all run on PHP, but the flaw sits in the PHP engine underneath them. A clean plugin dashboard does not mean the server runtime is patched.
Signs of exploitation already seen
Amazon’s threat intelligence team logged an attempt against its decoy servers on October 17, four days before the fix, according to Amazon reporting cited in security coverage. Cloudflare said on October 21 that it was seeing early attacks, and one research team reported a confirmed attack against specific WordPress versions that works before any login.
The European Union Agency for Cybersecurity joined other authorities in urging organisations to act immediately, according to Okay News. It advised identifying every application that uses PHP — including cases where the dependency is not obvious — and working with hosting providers to install fixes, giving priority to systems exposed to the internet.
For site owners, the practical steps are straightforward: confirm which PHP runtime actually serves public requests, update it to a fixed release, restart the relevant workers, and verify the patched runtime is handling traffic. The National Security Agency added, according to October 23 coverage, that anything that cannot be updated should come offline.
