# PHP2Shell: Two Days of Records – From Exposure, Previews to Patches, What Your Website Should Do
On October 21, 2026, PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, patching two vulnerabilities (CVSS v4.0 9.2) in unvalidated remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619; known as PHP2Shell). The incident began with exposure on October 20, and within two days, various conflicting reports emerged. This guide is based on php.net’s announcements and two GHSA advisories, comparing each report with official statements from various agencies, security vendors, and communities. It specifies who made the statements, when they were made, and organizes actions for website administrators, Taiwanese corporate IT professionals, and security industry peers.
On October 21, PHP released patches for two CVSS 9.2 vulnerabilities. The incident began with exposure on October 20, and within two days, various reports appeared, such as “10 points out of 10,” “The EU wants everyone to shut down their machines,” “Attack tools have been leaked,” and “A second Log4Shell.” This guide is based on official announcements, comparing each report with the original text to identify discrepancies. The content includes a timeline (UTC and Taiwan time), descriptions of the two vulnerabilities, recommendations from various agencies, actual community discussions over two days, comparisons between Japan and Taiwan, and action plans for readers at all levels. No details exploitation are included; mitigation measures adhere to the official policy of “reducing exposure without compromising security.”
| `index.html` | The main page of the website (single file, containing styles; Mermaid is drawn using external scripts—the original code can still be read if the loading fails.) |
| `php2shell-cve-2026-109618.md` | The Markdown draft of this guide |
| `images/g4-hotel-keycard.png` | Illustration related to the concept (no text inside the image) |
| `share_post.md` | Content shared by the community |
| `.gitignore` | Files excluded from the `qa_*.png`, `*.*normalized.md` files |
No single original file was used. The main sources are php.net’s official announcement on October 21, 2026, and two GitHub Security Advisories. Details the sources can be found in the “Source List” section. Word-by-word transcripts are not included.
- [php.net Official Announcement (October 21, 2026)](
- [GHSA-w8hw-w9fx-j79w]( [GHSA-6wmf-4rv5-p3rp](
- [PHP Foundation Explanation](
- [CISA]( [UK NCSC]( [CERT-EU 2026-018]( [Japan IPA]( [Taiwan Security Agency Press Release](
The incident is still ongoing. The latest information is as of UTC 17:00 on October 21, 2026 (Taiwan time: 01:00 on October 22, 2026). Release status and the official URL are listed below:
- Release Status: Released (October 22, 2026)
- Public URL:
- GitHub:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
