On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Both score 9.2 on CVSS v4.0 and allow remote code execution without a login.
Security vendors report exploitation attempts. Amazon Threat Intelligence recorded the earliest on 17 October, four days before public disclosure.
What is affected
The PHP project says any installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Mod_php carries the highest risk, because a single unauthenticated request can trigger the flaw before any application code runs.
WordPress, Laravel, Magento and Joomla sites are in scope when they run on an unpatched PHP version. Researchers trace the earliest affected code to PHP 5.4.0, released in 2012.
Fixed versions
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting providers and Linux distributors received patches before the public release, so check with your provider before assuming you are exposed or covered.
If you cannot update today
Patching is the only complete fix. Reported PHP team guidance lists two configuration changes that reduce exposure: setting memory_limit=-1 so applications cannot override it, and setting session.upload_progress.enabled=0. All PHP workers must be restarted afterwards.
Cloudflare has published WAF rules as a stopgap for traffic that passes through it. The UK National Cyber Security Centre advises taking offline any system that cannot be fixed straight away.
The harder case: unsupported PHP
PHP 7.4 to 8.1 have no official release for this flaw, only minimal source backports. Versions 5.4 to 7.3 are end of life, with no fix from the PHP project.
For example, a customer portal written in 2014 on PHP 5.6 and still serving quotes to clients has no supported route to a patch. The options are isolation or a rebuild, and the next critical flaw will leave the same portal in the same position.
Under current Cyber Essentials requirements, critical updates are expected within 14 days of release. A version that no longer receives updates cannot meet that.
Where to start
A Hollinford System Health Check can identify which applications run on which PHP versions, which face the internet, and which cannot be patched. The result is a ranked plan: what to isolate now, what to upgrade, and what to rebuild.