The most urgent story in cybersecurity news today is a flaw in the language that runs much of the web. Two critical vulnerabilities in the PHP runtime itself — tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell by researchers — allow unauthenticated remote code execution: an attacker who can reach your website can run code on your server without logging in. Both flaws are rated CVSS 9.2 by the PHP security team. PHP shipped an emergency out-of-cycle release on October 21, 2026 after exploit details leaked ahead of the planned disclosure — and Cloudflare reports it has already observed attack traffic. If your site runs on PHP (WordPress, Drupal, Joomla, Magento, Laravel, or anything custom), the check below takes under a minute.
Put the exposure in proportion: about 884,000 internet-facing hosts — 59 percent of the roughly 1.5 million hosts that reported any PHP version to Shodan on October 20 — reported running PHP 8.1 or older, the versions that get no upstream fix. Banner data is not a confirmed-affected list, and a further ~740,000 hosts reported PHP without a version at all — but even with those caveats, end-of-life PHP is plainly the largest part of the problem.
The timeline is why this became an emergency. On October 20, a post claimed two PHP RCE flaws would be disclosed on October 22 — with a CVSS 10.0 figure and a claim that everything since PHP 5 was affected. Researchers at watchTowr confirmed the flaws were real and under embargo; the 10.0 score was the leak's number, PHP's own rating is 9.2, and the "everything since PHP 5" scope was not confirmed by any vendor advisory at leak time. PHP moved the release up a day, publishing its advance notice at 19:33 UTC on October 20 and shipping the fixes on October 21. Meanwhile the defensive race had already started: Cloudflare said it observed attackers probing its customers and mutating payloads to evade rules, and switched on WAF protections for free and paid customers at 03:02 UTC — hours before the patches landed. For comparison, when the PHP CGI flaw CVE-2024-4577 became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours. PHP flaws of this class do not get a grace period.
The defensive response then escalated to something rarely seen: governments taking their own websites offline on purpose. CERT-EU, the European Union's cyber emergency team, advised organisations that could not apply the fixes to consider taking affected websites offline — and many did, preventively, ahead of the 14:00 UTC release. In the Netherlands, following the example of the country's own national cyber security centre, organisations pulled public sites offline including the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites of the country's five largest political parties, and several hospital websites. In Finland, the state IT provider Valtori took government public-network services offline as a precaution. In France, the Interior Ministry temporarily took local-government prefecture websites offline while awaiting a fix. In Germany, the federal IT provider ITZBund took several websites offline — a government spokesman stressed the move was purely preventive and that no security incidents were known. In Denmark, the municipal IT company Kombit shut down several services, including the national school communication platform. The US National Security Agency gave similar advice, urging organisations that cannot update immediately to take affected systems offline until the flaws are mitigated. To be clear about what this wave was: precautionary shutdowns by defenders racing a disclosure clock — not confirmed breaches.
Update, October 23, 2026: Reuters reported an exploitation scorecard, and it cuts both ways. Hunt.io's head of research, Esteban Borges, said the criminals his firm tracks had, as of 2:00 PM Eastern on Thursday, October 22, failed to build a working exploit tool for the PHP flaws, despite aggressive attempts that Amazon and Cloudflare also observed. Cloudflare CEO Matthew Prince told Reuters he had seen anecdotal evidence of compromises linked to the flaw. Both claims stand as reported; neither changes the patch-today advice above, because attack traffic is confirmed either way. The same Reuters report put PHP2Shell in a larger frame: AI helped drive a doubling in software flaws discovered year on year (VulnCheck research, not yet published), and Prince expects near-weekly fire drills for a couple of years. Our readiness check for that cadence: AI-Discovered Bugs Fire Drill Check.
Update, October 23, 2026: PHP has flagged a separate possible code execution path, tracked as CVE-2026-115560, that the October 21 emergency releases do not fix. It opens only when all of these hold at once: the application sets session.serialize_handler to php_binary or php_serialize in its configuration, then switches it to php at runtime with ini_set() before calling session_start(), and session upload progress is still enabled (it is on by default). An application that never changes the serialize handler at runtime is not exposed through this path. PHP calls the combination unlikely in practice, is fixing it in the regular release cycle, and will publish the full advisory with the next release. It has not named affected versions or a severity score, and no exploitation of CVE-2026-115560 has been reported. The mitigation is one line, the same line the October 21 advisory for CVE-2026-109619 already listed: set session.upload_progress.enabled=0. If you applied it then, you need nothing more for this one.
| Your branch | Fixed in | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update to 8.5.12 or later |
| PHP 8.4 | 8.4.27 | Update to 8.4.27 or later |
| PHP 8.3 | 8.3.36 | Update to 8.3.36 or later |
| PHP 8.2 | 8.2.35 | Update to 8.2.35 or later |
| PHP 8.1 and older | — | End of life: no upstream fix. Distro/LTS backport, source backport (7.4 / 8.0 / 8.1), or upgrade |
Two operational details that decide whether the update actually protects you. First, restart the PHP workers after updating: a web-server reload alone can leave detached PHP-FPM or LiteSpeed workers running the old, vulnerable build — verify the new version answers real web requests, not just the CLI. Second, Linux distributions and LTS vendors received patches in advance, so a distribution package with a backported fix counts — but verify it explicitly; PHP noted that the volunteer-maintained Remi repository packages would not have updates on release day, and pointed users to distribution packages or source builds instead.
Pick your PHP branch and patch number (the x.y.z part of your version — from php -v or your hosting panel). Everything runs in your browser; nothing is sent anywhere.
Distro builds: read the changelog, not the version string. Linux distributions and LTS vendors often ship the fix inside a package that keeps an older-looking version number. If your PHP comes from a distribution package, the package changelog — checked for CVE-2026-109618 and CVE-2026-109619 — is the authority on whether you are patched, not the bare version this checker compares. That is Debian's published advice for exactly this situation, and it overrides a "vulnerable" verdict below.
BreachHunter — Ingenious AI's intrusion and breach-signal hunter — exists for exactly the window PHP2Shell opens: the hours between "exploit traffic observed" and "your patch is verified live," when the question stops being are we exposed and becomes did anyone get in. Get early access on WhatsApp.
1. What does a PHP2Shell flaw let an attacker do?
2. Which PHP setup does PHP consider highest risk, and why?
3. Your site runs PHP 8.3.30. What is the fix?
4. You updated PHP and reloaded the web server. Why might you still be vulnerable?
5. Do the advisory's configuration settings fully protect an unpatched server?
PHP2Shell is the name security researchers gave to two critical vulnerabilities in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 by the PHP security team. CVE-2026-109618 is a remote code execution flaw triggered when an out-of-memory condition interrupts PHP before request data is fully initialized; CVE-2026-109619 lets internal state from one request survive into a later request handled by the same worker. Either can let an unauthenticated attacker run code on a web server. The name is the researchers', not PHP's; the flaws were disclosed by Calif.io, Wiz, OpenAI, and Quarkslab after exploit details leaked ahead of the coordinated release.
PHP says every installation that serves web requests is at risk, across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php considered highest risk because a demonstrated exploit triggers before any application code runs. The fixes shipped October 21, 2026 are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — any earlier release on those branches is affected. PHP 8.1 and older receive no upstream fix; the PHP security team provided minimal source-level backports for 7.4, 8.0, and 8.1 for people who build PHP from source, and some Linux distributions and LTS vendors ship their own backports.
On the server itself, run php -v in a terminal. On shared hosting, the version appears in your hosting control panel (cPanel, Plesk, or your host's dashboard), usually under PHP settings. A temporary phpinfo page also shows it — view it once and delete it immediately; a public phpinfo page is itself an information leak. Managed hosting? Get the exact version in writing.
Attack traffic has been observed. Cloudflare said it saw attackers targeting its customers and mutating payloads to get around its rules, and its WAF protections went live at 03:02 UTC on October 21, 2026 for free and paid customers, hours ahead of the fix release. Huntress reported no exploitation in its partner environments as of October 20 and no known public proof of concept at that time, and watchTowr listed the flaws as not in CISA's KEV catalog as of October 21. Because exploit details leaked before the coordinated release, defenders are treating this as patch-today, not patch-this-month.
It will not receive an upstream PHP fix. In order of preference: upgrade to a supported branch (8.2 or newer) and then to its fixed release; take a verified backport from your Linux distribution or LTS vendor; if you build PHP from source, apply the PHP security team's minimal backports for 7.4, 8.0, or 8.1; or take the system off the public internet, or behind a WAF, until you can do one of the above. About 884,000 internet-facing hosts reported PHP 8.1 or older in Shodan banner data on October 20, 2026 — 59 percent of the hosts reporting any PHP version — so end-of-life PHP is the largest part of the exposed population.
Sources: The Hacker News, October 21, 2026 (the leak timeline, watchTowr's confirmation, PHP's advance notice, the Mallory/Shodan host counts, and the Huntress/CERT-EU preparation steps) · Patchstack security advisory, October 21, 2026 (fixed versions, mod_php risk, backport and Remi-repository notes) · the PHP project's October 21, 2026 security advisory (affected scope, fixed releases, partial configuration measures) and Cloudflare's PHP2Shell disclosure (observed attack traffic; WAF protections live 03:02 UTC, October 21), as reported in the coverage above and cross-checked across CyberPanel's and the NCSC's October 21 response notes · Reuters, October 21, 2026 (European government websites taken offline as a precaution, and the NSA's take-systems-offline advice) · Reuters, October 23, 2026 (Hunt.io's no-working-tool-yet finding, Prince's anecdotal-compromise counterpoint, and the VulnCheck doubling figure) · PHP project news archive, October 23, 2026 (informational advisory: session upload progress — the CVE-2026-115560 conditions, the fix in the regular release cycle, and the upload-progress mitigation).