Cybersecurity / Security Advisories
CRITICAL SECURITY ADVISORY · UPDATED 26 OCT 2026
PHP2Shell: two critical PHP flaws. Patch your servers now.
Two vulnerabilities in PHP itself let an attacker run code on a web server with a single crafted request, no login needed. Fixes shipped on 21 October 2026. Here is what is confirmed, how to check if you’re exposed, and which sources to trust.
THREAT STATUS · LIVE
SEVERITY
Critical · CVSS v4.0 9.2 (both)
LOGIN NEEDED
None (unauthenticated RCE)
AFFECTS
Every PHP version serving web requests
FIXED IN
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
EXPLOITATION
Reported in the wild (see status)
Patch available · No complete workaround
CHECK YOUR WEBSITE
Check your PHP version in 10 seconds.
Enter your website to see whether it reports a patched PHP version. If the version is hidden, we’ll show you how to find it, and you can request a free vulnerability scan.
FREE PHP VERSION CHECK
Is your website exposed to PHP2Shell?
Enter your school's website. We read the PHP version it publicly reports and compare it against the patched releases.
Passive check: one normal page load, public headers only. Please check only sites your school owns or manages. Results are a first indicator, not a security audit.
FREE VULNERABILITY SCAN
Want the full picture?
A version check sees one website. Our free scan looks across your school's internet-facing systems.
- Every PHP server, panel and appliance we can find
- Patch status confirmed with your hosts and vendors
- Other critical exposures, ranked by risk
- A plain-English report your board can read
THE 30-SECOND VERSION
What every school needs to know.
01 · WHAT HAPPENED
Two memory bugs in PHP core
CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”, sit below WordPress, Laravel or any plugin. Details leaked before the fix, and PHP pushed an emergency release.
02 · WHO IS AFFECTED
Anything that runs PHP for the web
PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed setups. That includes school websites, hosting panels, firewalls with PHP admin pages and vendor appliances.
03 · WHAT TO DO
Update PHP. Then verify.
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution’s patched package), restart PHP workers, and confirm. PHP 8.1 and older get no official fix.
THE VULNERABILITIES
Two flaws, one patch.
Both are use-after-free memory bugs (CWE-416) rated 9.2 Critical by the PHP Group. One update fixes both.
CVE-2026-109618 · GHSA-w8hw-w9fx-j79w
Remote code execution via out-of-memory corruption
When PHP runs out of memory mid-request, it can abort while internal data is only half set up. The cleanup step then trusts that broken data, and attackers can steer it to run their own code. Reported attack paths go through file-upload (multipart) request parsing.
CVE-2026-109619 · GHSA-6wmf-4rv5-p3rp
Remote code execution via stale global state
Some internal pointers can outlive the request memory they point to. The next request may then read that freed memory, which can leak data or be turned into code execution. Confirmed paths include session upload progress and, on PHP 8.5, fatal error backtraces.
AFFECTED VERSIONS
Find your branch. Match the fixed release.
| PHP branch | Vulnerable | Fixed release | Status |
|---|---|---|---|
| 8.5 | Before 8.5.12 | 8.5.12 | Patch out |
| 8.4 | Before 8.4.27 | 8.4.27 | Patch out |
| 8.3 | Before 8.3.36 | 8.3.36 | Patch out |
| 8.2 | Before 8.2.35 | 8.2.35 | Patch out · EOL 31 Dec 2026 |
| 8.1, 8.0, 7.4 | All versions | No official release | Distro / LTS backport or upgrade |
| 7.3 and older (incl. PHP 5) | All versions | None | Upgrade required |
Heads-up on version numbers: Ubuntu, Debian and Red Hat often backport fixes without changing the version shown. A patched Ubuntu 24.04 can still report PHP 8.3.6. On those systems, check the package against your distribution’s security notice, not the version number alone.
IS IT BEING EXPLOITED?
Treat it as actively targeted.
Sources differ on timing, but security researchers report attacks in the wild and public exploit code is circulating. Plan as if internet-facing PHP is being probed today.
CISA · 21 OCT
Urged immediate patching
CISA’s alert told organisations to update right away and said it had not yet observed exploitation when it published.
WATCHTOWR · 21 OCT
Exploitation observed
watchTowr reported attacks against its honeypot network from 21 October and confirmed older branches, including PHP 5, are affected.
AMAZON THREAT INTEL
Early attempts reported
Per SOCRadar, Amazon saw first exploitation attempts on 17 October, four days before fixes shipped.
CISA KEV · 23 OCT
Not yet listed
Neither CVE was in CISA’s Known Exploited Vulnerabilities catalog as of 23 October. Check the live catalog for updates.
HOW TO CHECK
Five steps to know where you stand.
01 · FIND
Find every place PHP runs
Websites, the WordPress host, hosting panels (cPanel, Plesk), containers, firewalls with PHP admin pages (pfSense, OPNsense) and vendor appliances. PHP hidden inside a product is the easiest to miss.
02 · CHECK
Check the version the web server uses
WordPress: Tools → Site Health → Info → Server. Servers: php -v, then check the FPM or Apache module too. On Debian/Ubuntu, php8.x-fpm and libapache2-mod-php8.x are separate packages and can lag behind the CLI.
03 · COMPARE
Compare against the fixed release
Upstream builds need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Distribution builds: match your package to the vendor notice (e.g. Ubuntu USN-8948-1; Debian 12 8.2.35-1~deb12u1, Debian 13 8.4.27-1~deb13u1).
04 · PATCH
Update and restart PHP workers
Install the patched package, then restart PHP-FPM or Apache so old workers stop serving requests. Managed host? Ask for the exact patch version and date in writing.
05 · VERIFY
Confirm and watch for signs of attack
Re-check the version. Alert on PHP workers (php-fpm, php-cgi, httpd, apache2) spawning shells or unexpected child processes, which is the typical sign of exploitation.
CAN'T PATCH TODAY?
Stopgaps only. Not a fix.
PHP says its temporary measures reduce exposure to specific attack paths but do not make an installation safe. In PHP’s words, updating is “the only safe choice.” Use these only while patches roll out, and remove them afterwards.
session.upload_progress.enabled = 0
Blocks one confirmed path for CVE-2026-109619 only. Does nothing for CVE-2026-109618. WordPress doesn’t use this feature.
fatal_error_backtraces = Off (PHP 8.5)
On by default in 8.5. Turning it off blocks the confirmed backtrace path for CVE-2026-109619.
Server-level memory limits
php.net’s guidance for CVE-2026-109618 is to remove PHP’s own memory limit in a way apps can’t override, cap request size, and enforce memory limits outside PHP. Narrows the risk, doesn’t close it. A job for your server admin. Don’t use RLIMIT_AS / RLIMIT_DATA.
WAF / IDS rules
Cloudflare and VulnCheck have shipped rules for the known attack vectors. Useful in front of apps you can’t patch today.
Isolate internet-facing PHP apps
CERT-EU advised isolating exposed PHP applications until patched.
VENDOR & PLATFORM ADVISORIES
What your vendors have said.
IBM · BULLETIN 7293574
IBM API Connect
Vulnerable: v12.1.0.0–v12.1.1.3 and V10.0.8.0–V10.0.8.13 on-prem. Fix: apply iFix KI505348 for your release from IBM Fix Central. IBM lists no workaround. Published 22 Oct, updated 24 Oct.
WORDPRESS
No WordPress update needed
The flaw is in PHP, not WordPress, plugins or themes. Keeping WordPress current does not protect you. Your host or admin must update PHP.
UBUNTU · USN-8948-1
Patched packages out
Fixed for 22.04, 24.04, 26.04 and 26.10. Ubuntu 20.04 is fixed for Ubuntu Pro subscribers only.
DEBIAN
Security updates published
Debian 12 (bookworm) php8.2 8.2.35-1~deb12u1; Debian 13 (trixie) php8.4 8.4.27-1~deb13u1.
LARAVEL FORGE
Manual update required
Forge’s automatic security updates do not patch PHP. Update PHP on each server yourself.
RED HAT / OTHER VENDORS
Check your vendor portal
Public reports show Red Hat’s fix status as unconfirmed at the time of writing. For SIS, LMS and other hosted school platforms, ask each vendor for their PHP2Shell status.
LEGIT OR NOT?
Trust official sources. Ignore the noise.
The leak created a flood of half-right advice. The leak claimed CVSS 10.0, PHP’s official score is 9.2. Several “fixes” shared before release turned out to be partial. Public exploit repositories are appearing on GitHub.
Never run exploit or “checker” code from unofficial repositories on school systems. Use vendor scanners (e.g. Tenable plugins 115719–115722) or your IT provider.
✓ VERIFIED SOURCES
- PHP security advisory (php.net)Primary source. Fixed versions, mitigations, caveats.
- GitHub advisories GHSA-w8hw / GHSA-6wmfPHP’s own technical advisories for each CVE.
- CVE.org / NVD recordsOfficial CVE entries published by PHP as CNA.
- CISA KEV catalogAuthoritative list of exploited vulnerabilities. Check for additions.
- CERT-EU 2026-018 · UK NCSCGovernment CERT guidance on patching and isolation.
- Your OS / hosting vendor noticeThe source of truth for backported packages.
TIMELINE
How it unfolded.
- 17 OCTFirst exploitation attempts reported by Amazon threat intelligence (via SOCRadar).
- 20 OCTPHP pre-announces an emergency release after details leak. CERT-EU issues advisory 2026-018.
- 21 OCT · 14:00 UTCPHP releases 8.5.12, 8.4.27, 8.3.36, 8.2.35 and its advisory. CVEs published. CISA urges patching. Ubuntu ships fixes.
- 22 OCTIBM publishes API Connect bulletin. Hosts roll out patches and mitigations.
- 23 OCTNeither CVE yet in CISA KEV.
- 24 OCTIBM updates its bulletin with v10 LTS fixes.
If it runs on WordPress, Drupal, Joomla or any PHP platform, yes, until the server’s PHP is patched. Ask your host or web team which PHP version and patch date your site is on.
No. The flaw is in PHP itself. WordPress.org has confirmed no WordPress update is planned or required. The fix is the PHP update.
Confirm it. Most managed hosts have patched or applied mitigations, but some platforms (for example Laravel Forge) don’t update PHP automatically. Get the patched version in writing.
PHP won’t release fixes for these. Use a distribution or LTS vendor backport if one exists, and plan an upgrade to a supported branch (8.2 to 8.5). PHP 8.2 itself reaches end of life on 31 December 2026.
No. This is a server-side flaw in PHP. It matters for systems that serve web pages with PHP, including some vendor platforms your school uses. Ask your SIS, LMS and web vendors for their status.
We can inventory where PHP runs across your school, confirm patch status with your vendors and hosts, and apply stopgaps where patching has to wait. Start with a free vulnerability assessment.
SOURCES
Public references
- PHP: Security advisory, 21 Oct 2026
- GitHub: GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub: GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- IBM: Security Bulletin, Two Critical PHP Vulnerabilities
- Google Cloud / Wiz: Responding to the PHP vulnerabilities
- watchTowr: PHP2Shell FAQ
- Tenable: PHP2Shell FAQ
- Tanium: Responding to PHP2Shell
- SOCRadar: PHP2Shell affected versions and fixes
- SANS ISC: Critical PHP Vulnerability diary
- UK NCSC: Critical security issue affecting PHP
- Ubuntu: USN-8948-1
- Laravel Forge: PHP security advisory
- Codeable: What WordPress site owners need to do
- Checkmarx: Misinformation around the PHP fixes
Information current as of 26 October 2026 and compiled from public advisories. Details may change; always confirm against the official PHP advisory and your vendor’s notice before acting. This page is for awareness and is not a substitute for a security assessment.
NOT SURE IF YOU'RE EXPOSED?
Find every PHP server before an attacker does.
We’ll check your websites, hosting and vendor platforms for PHP2Shell exposure and tell you exactly what to fix first. Our contact form takes about 10 seconds.