Security problems are growing: PHP fixes two critical flaws
On 21 October 2026 PHP released emergency updates for two flaws known as php2shell. What they are, what we did and five steps every site owner should take now.
On 21 October 2026 the PHP project released emergency updates for two critical vulnerabilities, known together as php2shell. PHP runs WordPress, WooCommerce and many custom-built sites, so if your website is one of them, this concerns you.
What php2shell is
Two flaws are behind it: CVE-2026-109618 and CVE-2026-109619. With a specially crafted web request, an attacker who has no account on the site can run code on the server (PHP security advisory). The PHP Group rates both as critical, with a score of 9.2 out of 10 (NVD: CVE-2026-109618, NVD: CVE-2026-109619).
Every PHP installation that serves web pages is affected, whatever the server setup. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no official fix from the PHP project; some Linux distributions and hosting vendors provide their own patched packages.
What we did
When the fix was published, we checked which PHP version each site we manage runs and compared it with the fixed releases. On the servers where the version number had not changed, we asked the hosting provider to confirm in writing that the fix is included in its PHP builds, and we are following that up. We also looked for signs that the flaw had been exploited on our sites, and found none.
Why it will happen again
ENISA, the EU agency for cybersecurity, reports that attackers turn newly disclosed vulnerabilities into large campaigns within days (ENISA Threat Landscape 2025). In its latest report, covering 2025, a vulnerability was the way in for 60.4% of the intrusions where ENISA could identify the entry point. The same report notes that AI is already speeding up how vulnerabilities are found and exploited, and expects it to make attacks faster and easier to run at scale (ENISA Threat Landscape 2026).
What you should do now
- Ask your hosting provider, in writing, which PHP version your site runs and whether it includes the php2shell fix. If the version number has not changed, ask them to confirm that the fix was backported.
- If your site runs PHP 8.1 or older, plan an upgrade: the PHP project no longer fixes those versions.
- Update the CMS, plugins and themes, and remove the ones you no longer use.
- Check who has an admin account, and turn on two-factor authentication.
- Remove backups, log files and old test copies from public folders.
If we manage your website, these checks are already part of our work. If you are not sure who manages yours, write to us.
