Two critical PHP security vulnerabilities, collectively known as PHP2Shell, have triggered urgent warnings for website administrators worldwide. The flaws could allow attackers to execute malicious code remotely on vulnerable servers, potentially exposing websites, applications and sensitive information.
The PHP development team released emergency security updates on October 21, 2026, after technical details of the vulnerabilities surfaced ahead of the planned disclosure.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, each carry a critical CVSS v4.0 severity score of 9.2.
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to two security flaws in PHP, the widely used programming language that powers dynamic websites and online applications.
Both vulnerabilities affect PHP’s core runtime rather than a particular website plugin or application.
The first vulnerability, CVE-2026-109618, involves memory corruption during request cleanup. The second, CVE-2026-109619, involves the reuse of invalid memory references between requests.
Attackers could potentially exploit these weaknesses to execute code on affected servers without login credentials. Successful exploitation could also expose sensitive information stored in server memory.
Why PHP2Shell threatens websites
PHP powers major content management systems, including WordPress, Drupal and Joomla.
Because the vulnerabilities exist in PHP itself, websites using these platforms may face risks if their servers run affected PHP versions. However, using WordPress does not automatically mean a website is compromised. The actual risk depends on the PHP runtime version, server configuration and installed security updates.
The vulnerabilities affect several PHP server environments, including Apache mod_php, PHP-FPM and other supported PHP execution methods.
Security researchers have highlighted Apache mod_php deployments as particularly concerning because attackers may exploit the flaws before the website’s application code executes.
Which PHP versions are affected?
The vulnerabilities affect specific PHP release branches. Website owners should check their installed versions against the official PHP security advisories and confirm that their hosting providers have applied the relevant fixes.
Administrators running older, unsupported PHP versions should consult their hosting providers or operating system vendors for applicable security updates.
PHP releases emergency security patches
The PHP development team issued security updates on October 21 to address both vulnerabilities.
The reported fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Administrators should install the appropriate security release for their PHP branch. Those running unsupported versions should migrate to a supported release or consult their operating system vendor for applicable fixes.
Updating the PHP runtime is essential because changes to website plugins or themes alone cannot resolve these core vulnerabilities.
Cloudflare deploys protections against attacks
Cloudflare introduced web application firewall protections designed to detect and block attempts to exploit the PHP2Shell vulnerabilities.
The company said it deployed protections for customers using its free and paid WAF services ahead of the public disclosure.
Security researchers have also reported attempts to exploit the flaws, increasing concerns about attacks against servers that remain unpatched.
Although firewall protections can help reduce exposure, they cannot replace the PHP security updates.
How website owners can protect their sites
Website owners and server administrators should check which PHP version their websites use and confirm that they have installed the relevant security fixes.
Those using managed hosting services should contact their hosting providers if the patched PHP version is not available in their control panel.
Administrators should also review server logs for suspicious activity, maintain reliable backups and keep their website software updated.
For WordPress users, updating plugins, themes and WordPress itself remains important. However, fixing PHP2Shell requires an updated PHP runtime.
Read more : Cybersecurity threats to websites
Why these vulnerabilities matter
The PHP2Shell vulnerabilities highlight the risks associated with security weaknesses in widely used web infrastructure.
Unlike vulnerabilities limited to individual applications, flaws in a core programming-language runtime can potentially affect many different websites and services.
With security patches now available, administrators should update affected systems promptly to reduce the risk of exploitation.
