Why check this now
In October 2026, two critical PHP vulnerabilities were disclosed, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Patches were released on 21 October, and exploitation has been reported since. If your site runs PHP, this checklist helps you confirm it is up to date.
The patched versions
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If your version is older, it needs updating. Many hosts can do this for you. WordPress, Drupal, Joomla, Magento, Laravel, Symfony and phpMyAdmin were all shown to be exploitable.