PHP2Shell: in October 2026, PHP patched two critical flaws that can allow remote code execution
On 21 October 2026, the PHP project released a security update for two critical vulnerabilities known as PHP2Shell. An unauthenticated remote attacker may be able to run code on the server; PHP said that updating is the only safe approach.
What PHP announced
On 21 October 2026, the PHP project released a security update fixing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), known together as PHP2Shell. PHP said an unauthenticated remote attacker may be able to run code on the server. The issue affects PHP installations that serve web requests, including PHP-FPM, Apache with mod_php (which PHP considers the higher-risk configuration), php-cgi, FrankenPHP and LiteSpeed. PHP also said there are no complete workarounds, and that updating is the only safe approach.
The fixed versions
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project. Some distributions or long-term-support vendors may provide backported fixes, so this should be checked with the vendor, or the system should be upgraded to a version that is still supported.
What CISA and HKCERT said
The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on the same day, and on 26 October added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) also issued an extremely high-risk security bulletin on 22 October, and advised organisations to patch affected systems promptly. HKCERT also noted that, besides ordinary website servers, PHP may be embedded in the administration interfaces of some applications, networking or security equipment, so an inventory should not rely only on the version shown by the main website.
What this means for smaller firms
If a company website, webmail, customer system or office appliance uses PHP — including content-management websites built with PHP — you should ask the hosting provider or the person who looks after the system to confirm the current PHP version, and to update it to a patched release as soon as possible.
Sources
This article is based on public reports and official statements. It is for general reference only, and is not legal advice. If you would like to discuss your own systems or security arrangements, please contact us.
Related services
Please tell us about your current situation
Please call, use WhatsApp, or complete the enquiry form. We will review the situation and recommend a suitable course of action.