PHP2Shell: critical PHP vulnerability patched October 2026
PHP2Shell is two critical PHP vulnerabilities with patches released 21 October 2026. The fixed versions and what to do.
Nikolas Gannon · · 2 min read · Systems and security
On 21 October 2026 the PHP team released patches for PHP2Shell, two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10. On an unpatched server, both allow someone to run code on a PHP site without logging in.
The fixed versions
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If you run an older branch, the PHP security team has published source backports for PHP 7.4 through 8.1. The simpler path is to move to one of the fixed versions above.
How it differs from a plugin update
Most WordPress security news is about a single plugin or theme. This flaw is in PHP, the language underneath, so it affected many applications at once. WordPress, Drupal, Joomla, Magento, Laravel, Symfony, phpMyAdmin and Nextcloud were all shown to be exploitable. Updating your CMS is still worth doing, but PHP needs updating as well.
What to do
- Check which PHP version your site runs. Your hosting dashboard or your host can tell you.
- Update to a fixed version, then restart PHP and your web server. If you use containers, rebuild the images.
- If you cannot update straight away, apply the published mitigations in the meantime.
- Run through the basic checks for signs of compromise. If something looks wrong, restore from a clean backup rather than patching over it.
If you are on managed hosting, ask your host whether they have already applied the update. Many have.
Longer term
Patching is the fix for this vulnerability. Beyond that, some businesses decide they would rather not run server-side PHP at all and move to a static site. It removes this kind of update from the list, though it comes with its own trade-offs, which WordPress vs static site for small business covers.
If you tell me what your site runs, I am happy to help you work out what makes sense. The audit is free.
Free resource: Website security check
Free resource: Website health check
Read next: Why PHP sites are being targeted in 2026 · Signs your PHP website has been hacked: the checks to run
Questions
What is PHP2Shell?
PHP2Shell is the name for two critical remote code execution vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 out of 10.
Which PHP versions fix it?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Older versions need updating.
Is PHP2Shell being exploited?
Exploitation has been reported, so it is worth updating soon rather than waiting for your next routine maintenance.