Skip to content
PHP2Shell Vulnerabilities Affect Millions of Unsupported PHP Servers

PHP2Shell Vulnerabilities Affect Millions of Unsupported PHP Servers

First seen 25 Oct 2026, 18:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 19:12 UTC
  • •884,000 servers are running unsupported PHP versions, exposing them to vulnerabilities.
  • •CISA recommends taking offline any PHP systems that cannot be upgraded.
  • •No official fixes are available for PHP versions 5.x, 7.x, 8.0, and 8.1.

PHP2Shell vulnerabilities have left millions of servers running unsupported PHP versions exposed. A Shodan count revealed 884,000 internet-facing hosts on unsupported PHP versions, with 740,000 more hiding their version. The vulnerabilities affect PHP versions 5.x, 7.x, 8.0, and 8.1, which have no official fixes. Organizations are advised to take PHP-based systems offline if they cannot upgrade. CISA recommends upgrading to supported PHP branches 8.4 or 8.5, as security support for 8.2 ends on December 31, 2026. The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, with no patches available for older versions. The PHP project has ceased updates for versions 8.1 and older, and users are urged to seek vendor backports or isolate their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Shodan count reveals vulnerable PHP hosts
A Shodan count identified 884,000 internet-facing hosts running unsupported PHP versions, highlighting the scale of exposure.
Notebookcheck
2026-10-25
PHP2Shell vulnerabilities disclosed
PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed, affecting multiple PHP versions with no fixes for older branches.
safeguard.sh

More articles in this cluster (3)

Following this threat?

Track Ubuntu and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

Which PHP versions are affected?
PHP versions 5.x, 7.x, 8.0, and 8.1 are affected, with no official fixes available.
What should organizations do?
Organizations should take PHP-based systems offline if they cannot upgrade to supported versions.
Are these vulnerabilities being actively exploited?
No confirmed exploitation has been reported; however, systems running unsupported versions are at risk.