PHP2Shell: Two Critical PHP Flaws Are Coming, and Here’s How to Get Ready

PHP2Shell is the nickname for two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and PHP has scheduled an emergency fix for October 21, 2026. If your site or server runs PHP, you should find out which version you’re on today. Don’t wait for the details to settle.

Here are the quick facts:

• Two bugs: CVE-2026-109618 and CVE-2026-109619, both remote code execution.
• Severity: PHP rates both 9.2 on CVSS v4.0; some early reports said 10.0.
• Fix: scheduled for 14:00 UTC on October 21, 2026, for PHP 8.2 to 8.5 only.
• Exploitation: Cloudflare says early attacks are emerging; others report none confirmed.

Those four lines are the short version. The rest of this post explains what is confirmed, what isn’t, and what to do first.

What we actually know about PHP2Shell

PHP published an advance notice on October 20 saying a critical security release was coming. The notice names no CVEs and says full details will arrive with the release. The CVE numbers came from a leaked post, as The Hacker News reports.

Security firm watchTowr says the leak is genuine and the bugs were under embargo. Its own FAQ gives a different release date, October 22, and notes that date also came from a leak. Treat the exact day as in flux and check php.net directly.

One claim is still unproven: that every PHP version since PHP 5 is affected. According to watchTowr, no official advisory has confirmed that scope.

Which PHP versions get a fix

Only the supported branches will be patched. Kevin Beaumont reported the version numbers below before release, and Tenable lists them as expected, not confirmed.

If you’re on an end-of-life branch, an upgrade is your only real answer. That matters because Mallory counted roughly 884,000 internet-facing hosts whose banners reported PHP 8.1 or older. A banner count isn’t proof of a vulnerable server, but it shows how many sites are stuck on old versions.

Is anyone attacking this yet?

The picture is mixed. Cloudflare’s CTO said the company is seeing early attacks emerging, per Tenable. watchTowr said it knew of no exploitation as of October 21, and the flaws weren’t in CISA’s Known Exploited Vulnerabilities catalog at the time of writing.

Exploit code is already circulating in places. Tenable hasn’t verified that any of it works, and warns that such code may contain malware. Don’t download and run it to “test” your own server.

How to prepare for the PHP2Shell patch

You can do most of the prep before the fix lands. Start with this checklist, in order.

• List every place PHP runs: web servers, hosting accounts, control panels, and software that bundles its own PHP.
• Check each PHP version. On a server, php -v shows it; on shared hosting, look in your control panel.
• Plan to update internet-facing systems first once 8.5.12, 8.4.27, 8.3.36 or 8.2.35 appears.
• If you use Linux packages, check your distribution’s advisory, since vendors often backport fixes without changing the version number.

The point of the list is speed: when the patch drops, you shouldn’t be hunting for servers. PHP core developer Gina Peter Banyard says patching is the only full fix, and PHP 8.6 release manager Joe Ferguson says settings like session upload progress won’t protect you, per Tenable.

What to do if you can’t patch right away

Some setups can’t update on the same day, such as old appliances and legacy apps. In that case, reduce exposure instead of ignoring it.

Cloudflare has deployed WAF rules for known exploit vectors, available on all plans including free. Cloudflare itself calls this a stopgap, and it only covers traffic that passes through Cloudflare. CERT-EU also advises isolating internet-facing apps from public networks until a fix exists.

Watch for PHP or web server processes launching shells or download tools. If you suspect a break-in, take the server offline, keep the logs, and look for new files in the web root, odd cron jobs, and new accounts. Our posts on the Ivanti Connect Secure zero-day and the Cisco Secure Email Gateway zero-day follow the same patch-first playbook.

Frequently Asked Questions

What is PHP2Shell?

It’s the informal name researchers gave two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. PHP itself didn’t choose the name.

Is my WordPress site affected by PHP2Shell?

WordPress runs on PHP, so the server underneath it matters. The risk depends on your PHP version and your host’s patching. Ask your host when it will apply the fix, and update PHP as soon as it’s offered.

Has PHP released the patch yet?

It was scheduled for 14:00 UTC on October 21, 2026, but at the time of writing the PHP releases page didn’t yet list the new versions. Check php.net for the confirmed list.

Will PHP 8.1 and older get a fix?

No. Those branches are end of life, and PHP isn’t expected to patch them. You’ll need to upgrade to a supported branch.

Our take

Don’t panic, but don’t coast either. Two critical remote code execution bugs in the language behind most of the web is a “drop what you’re doing” patch, and the real danger is the gap between the fix and your update. Inventory your servers now, patch internet-facing ones first, and retire anything on PHP 8.1 or older for good.