October 22, 2026: PHP maintainers have issued emergency security releases addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The flaws can allow unauthenticated remote code execution under vulnerable conditions. Administrators should prioritize supported-version updates rather than relying on partial workarounds.
What is PHP2Shell?
PHP2Shell is the name used in security reporting for the pair of PHP vulnerabilities disclosed with emergency fixes on October 21. PHP powers many web applications, including WordPress installations, so operators need to check the PHP runtime used by each site—not only the version of their content-management system.
Which PHP releases contain the fixes?
The PHP project published security updates for supported branches: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Check the official PHP release announcements for the exact version and advisories applicable to your deployment. An unsupported PHP branch requires an upgrade path or a verified vendor-maintained security backport; simply updating a WordPress plugin is not the same as patching PHP.
What should administrators do now?
- Inventory your servers. Record the PHP version running each website, API endpoint, background service and container.
- Apply the vendor’s patched release. Use trusted packages for your operating system or hosting provider and restart the relevant services.
- Check what is actually running. Verify the active runtime after deployment; multiple PHP versions may coexist on one server.
- Review exposure and logs. Look for suspicious requests and unexpected changes around the disclosure window. Escalate potential compromises to your security team.
- Update backups and recovery plans. Confirm backups are intact and access controls are appropriate while investigating any suspected incident.
Does a firewall rule solve the problem?
No complete mitigation is endorsed as a replacement for updating. The PHP development team explicitly warns that applying the security release is the safe response. A web application firewall may reduce some exposure but does not prove a vulnerable runtime is secure.
Has exploitation been observed?
Security researchers have reported attempts to exploit the flaws. Observed probing does not by itself establish that every targeted website was compromised. For reporting on activity before the public patches, see our separate PHP vulnerability exploitation timeline.
Sources: PHP project security releases (October 21, 2026); UK National Cyber Security Centre advisory. This report is informational and does not replace incident-response assessment of a particular server.
