Back Feeds.Feedburner

PHP2Shell: What the Vulnerability Means and Why Patching Is Urgent

Feeds.Feedburner • October 22, 2026

Two critical security vulnerabilities in the core of PHP affect a large proportion of websites – from personal WordPress blogs and online stores to government and public administration portals. Updates have been available since October 21. Website operators are strongly urged to install the patches immediately.

On October 21, at around 4 p.m. German time, the PHP project released unscheduled security updates addressing two highly critical vulnerabilities. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. With a severity score of 9.2 on a scale that goes up to 10, these vulnerabilities rank among the most serious. There is nothing ordinary internet users can do them directly, but operators of vulnerable web servers need to take immediate action.

The vulnerabilities have already been addressed in most major Linux distributions ( see list ). Web hosting providers and website operators now need to install the updates as quickly as possible.

Originally, details of the vulnerabilities were not supposed to be disclosed until today (October 22). However, because information the vulnerabilities had already leaked to the public, the PHP project also brought forward the release of the patches.

Put simply, PHP is a programming language that acts as a link between a website and the systems running behind the scenes. When a user requests a web page or enters information on a website, PHP comes into play to retrieve information from the web server itself or from a database and then make that information available to the user on the website. PHP is used in many well-known systems, from WordPress and TYPO3 to Joomla, Plesk, and numerous e-commerce platforms.

One important distinction: The vulnerability exists in PHP itself, not in any of the systems mentioned above. Even someone who has installed the very latest version of a system such as WordPress may still be vulnerable if the underlying PHP version is outdated.

The vulnerabilities described here allow an ordinary user to gain access to these backend systems without having to authenticate. An attacker can not only access the server's memory, which may contain things such as API keys or passwords, but also potentially steal data or install malware.

Private users: Anyone who merely visits websites does not need to take any immediate action on their own computer or smartphone. PHP runs on the server, not in the browser. However, it would be premature to give the all-clear. If an online store, forum, or community organization's website is compromised, data stored there could be stolen. And anyone who runs their own blog or small website and manages the underlying CMS themselves is also a website operator – and should therefore take action.

Businesses: For companies, the affected systems may include online stores, customer portals, intranets, and marketing websites. A successful attack could lead to data breaches, website manipulation, malware infections, or provide attackers with a foothold in the internal network. Potential reporting obligations under the GDPR may also apply. Companies that host their websites with an external provider should find out whether the updates have already been installed. Those running their own servers or Docker containers are responsible for updating them themselves. Incidentally, PHP is also used in numerous appliances, such as routers and firewalls, that are managed and configured through a browser-based interface. Updates are important here, too; these are generally provided by the manufacturer.

Public authorities: Government agencies and other public institutions operate numerous PHP-based portals, citizen services, and content management systems. Germany's Federal Office for Information Security (BSI) has issued a level 3 out of 4 cybersecurity warning (orange), while CERT-EU has published its own advisory . Both recommend patching immediately. Where this is not possible, they advise considering temporarily disconnecting affected systems from the internet.

Affected PHP versions: All versions from 5.4 onward (php-fpm, php-cgi, FrankenPHP, LiteSpeed)

Patched PHP versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35

Older PHP versions: No updates available, only backported patches

Patched Linux distributions and platforms (as of October 22, around 1 p.m. German time): Debian 12 ( DLA-4848-1 ) Debian 13 ( DSA-6574-1 ) Debian unstable Ubuntu 14.04 through 26.10 ( USN-8948-1 / USN-8948-2 ) RHEL 8, 9, and 10 (PHP 8.4 on RHEL 9 is still pending) Rocky Linux 8, 9, and 10 SLES 15 SP7 Alpine Linux edge & 3.24 Plesk (Linux and Windows), cPanel, DirectAdmin, official Docker image

Patched Linux distributions and platforms (as of October 22, around 1 p.m. German time):

Debian 12 ( DLA-4848-1 )

Debian 13 ( DSA-6574-1 )

Ubuntu 14.04 through 26.10 ( USN-8948-1 / USN-8948-2 )

RHEL 8, 9, and 10 (PHP 8.4 on RHEL 9 is still pending)

Rocky Linux 8, 9, and 10

Alpine Linux edge & 3.24

Plesk (Linux and Windows), cPanel, DirectAdmin, official Docker image

Update PHP packages through the control panel, the respective Linux distribution, or the responsible hosting provider.

Restart the web server after installing the updates.

Verify the active PHP version through the web server (simply running php -v in a shell is not enough!).

Rebuild and restart Docker images.

For systems running PHP 8.1 or older: either upgrade to a patched version OR isolate the system and disconnect it from the network.

Check logs for suspicious activity, particularly newly created PHP files, new or unknown administrator accounts, or cron jobs (especially dating back to October 20!).

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

PHP2Shell: What the Vulnerability Means and Why Patching Is Urgent

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Countries (1)

CVEs (2)

CWE Weaknesses (2)

Industries (2)

Platforms (9)

Tools (2)