PHP security update (php2shell): what to do now

• CVE-2026-109618

  Memory corruption after an out-of-memory error. A request that runs PHP out of memory at the wrong moment can leave PHP’s internal data half set up. PHP can then treat it as sound and corrupt memory. On Apache with mod_php, one request from a stranger can trigger it before any of your site’s own code runs.

• CVE-2026-109619

  Stale global state. A fatal error at the wrong moment can leave PHP pointing at memory that belonged to an earlier request. A later request handled by the same worker can then use it. Remote code execution was shown against a real application running on Apache with mod_php.

What the agencies say

CISA

Patch immediately and start with systems that face the internet. PHP is often part of other software, so list every system that runs it. A web application firewall may give some protection until you are patched. If you cannot update, or still run PHP 8.1 or earlier, take PHP-based systems offline until they are fixed.

CERT-EU

Every PHP install that serves web requests is at risk. Only an update fully fixes the flaws. The temporary settings it lists reduce exposure to some attack paths and do not make a server safe.

The PHP Foundation

The two releases are out and the Foundation says it is imperative to update now if you run PHP.

How to check your site

• Ask your host or developer which PHP version serves your website. Ask for the version the web server uses, because it can differ from the version on the command line.
• On WordPress, open Tools, then Site Health, then Info, then Server. The PHP version is listed there.
• Many hosting control panels show the PHP version in their settings.
• Remember other software. PHP often sits inside shops, booking tools and other products. NCSC-NL keeps a list of products that embed PHP.

W3Techs reports that PHP is used by 69.3% of the websites whose server-side language it can detect. About 35% of PHP sites run PHP 7 or older (22 October 2026).

1. 1

   Find out which PHP version runs your website

   Use the checks above, or ask. List every system that runs PHP, because it is often part of other software.

2. 2

   Ask your host or developer to confirm the fix

   Copy the email below, fill in your website address and send it today.

3. 3

   Update to a fixed version, or confirm a vendor backport

   The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run your own server, update PHP through your distribution’s packages or build the fixed source.

4. 4

   If you are on PHP 8.1 and older, plan the move now

   Ask about a vendor backport first. If neither a backport nor an upgrade can happen soon, CISA advises taking the PHP-based system offline until it is fixed.

5. 5

   Watch for signs of trouble

   CISA suggests looking for PHP worker processes that launch shells or download tools. Your host can check this. Keep a recent backup.

Hello,

The PHP project released security fixes on 21 October 2026 (22 October in Australia) for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell. They can let an outsider run commands on a web server without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

For our website, [website address], please tell me:

1. Which PHP version serves the website, and how is it run (PHP-FPM, Apache mod_php or something else)?
2. Has it been updated to a fixed version? If we use a vendor package, which package version carries the fix?
3. If we are on PHP 8.1 and older: those versions no longer get updates from the PHP project. Has a vendor backport been applied? If not, when will we move to a supported version?
4. Does any other software on the server embed PHP, such as a shop, booking tool or plugin? NCSC-NL keeps a list at https://github.com/NCSC-NL/php2shell
5. Until it is fixed, what limits our exposure? A web application firewall may help for a short time, but only the update fixes the flaws.

CISA advises patching immediately, and taking PHP-based systems offline if they cannot be fixed. Please reply by [date].

Thank you,
[your name]

Sources:
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
https://cert.europa.eu/publications/security-advisories/2026-018

How a preview works

1. 1

   Tell us your website address

   Use the form on this page. You tell us you own or manage the site.

2. 2

   Our team prepares a preview

   Companion reads your public pages and drafts the new site. A person reviews it before you see it.

3. 3

   You look it over and decide

   You review the preview and set the receptionist’s greeting. You go ahead only if you are happy.

About the preview. Our team prepares it and gets back to you. There is no charge for the preview.

Ask us which plan suits your site.

Prices are in Australian dollars, per month, including GST. Front Desk standard list is A$795. The founding price (A$495) is for the first 50 sites, locked for 12 months against a named case study, then the prevailing Front Desk list price. In return we ask for a named case study.

• The PHP Foundation

  Today’s PHP security release, and how we’re strengthening PHP security (opens in a new tab)

  The release, the two flaws and the fixed versions.

• CISA (US Cybersecurity and Infrastructure Security Agency)

  Critical vulnerabilities in PHP require immediate patching (opens in a new tab)

  Patch immediately, internet-facing systems first. Offline advice for systems that cannot be fixed.

• CERT-EU

  Security advisory 2026-018: critical vulnerabilities in PHP (opens in a new tab)

  Affected setups, end-of-life versions and backports, and temporary mitigations.

• NCSC-NL

  php2shell: software that embeds PHP (opens in a new tab)

  A list of products that embed PHP and may be affected.

• W3Techs

  Usage statistics of PHP for websites (opens in a new tab)

  How many websites use PHP, and which versions.

This page is general information, not tailored security advice. Check the sources below and ask your host, developer or a qualified adviser about your own systems.