On 21 October 2026 the PHP project released emergency patches for two critical vulnerabilities in the PHP interpreter, collectively nicknamed PHP2Shell. Both allow unauthenticated remote code execution. CISA, the UK NCSC and several other national cyber centres issued advisories the same day.
If you run anything PHP-based that answers web requests, this one matters, and the window for comfortable patching has already closed.
What the flaws are
- CVE-2026-109618, remote code execution via out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialised, and request cleanup then treats that invalid data as valid.
- CVE-2026-109619, remote code execution via stale global state. Request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state.
Both sit in the interpreter core rather than in an extension or a framework, which is why the blast radius is so wide. Help Net Security reports that a working exploit has shown a single unauthenticated request can trigger the attack before any application code runs. Your own code being well written does not help you here.
Patch to these versions
CISA’s guidance is to update immediately to one of:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Most Linux distributions and LTS vendors received the patches ahead of public release, so check your vendor packages before building from source.
If you are on PHP 8.1 or older
The PHP project no longer supports PHP 8.1 and earlier. CISA is unusually direct about this: organisations that cannot update immediately, or that continue to run PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
Help Net Security reports that the PHP security team has also published minimal source backports for PHP 7.4, 8.0 and 8.1, intended for people who build from source or have no vendor providing long-term support. If an old PHP version is holding up a business system, this is the moment that technical debt becomes an operational risk.
Which setups are affected
CISA and Help Net Security both name the same configurations, and both single out the first one:
- Apache with mod_php, which PHP considers the highest risk
- PHP-FPM
- php-cgi
- FrankenPHP
- LiteSpeed
The NCSC makes a point worth repeating: do not limit your discovery to PHP versions you think are outdated. It warns that any version may be affected and that PHP is frequently bundled inside other software, including appliances, where its presence is not obvious.
Is it being exploited?
Carefully: as of its latest revision, CISA says it has not observed successful exploitation in the wild. Cisco, Palo Alto Networks and Fortinet have each said they are not aware of malicious use against their products.
There is one data point in the other direction. Amazon Threat Intelligence reported that its MadPot honeypot network recorded a PHP2Shell exploitation attempt on 17 October, four days before public disclosure, from an address tied to a commercial anonymisation service. Amazon believes this was a threat actor. How anyone obtained exploit details before disclosure is still unknown.
Details of the flaws also leaked ahead of the planned release. VulnCheck reproduced the bugs late on 20 October and reports that while dozens of proof-of-concept repositories have appeared, only a very small number implement the correct mechanism, and none of those defeat address space layout randomisation on x86-64 on their own. On ARM64 the protection can be brute-forced more easily.
The honest summary: no confirmed compromise of a real system has been published, working public exploits are limited so far, and none of that is a reason to wait. The research is moving quickly and the flaw is pre-authentication.
What to do, in order
- Inventory first. Find every PHP installation, including ones inside appliances and vendor software. Internet-facing systems first.
- Patch to a fixed version. Prioritise anything reachable from the internet.
- If you cannot patch, take it offline. That is CISA’s guidance, not ours.
- A web application firewall may help in the interim. CISA’s wording is that it “may provide some protection”. Treat it as breathing room, not a fix.
- Then go looking. Monitor for PHP worker processes launching shells or downloading tools, and for unexpected file or database access.
If we host your environment
Our managed customers sit behind a high-availability Fortigate firewall cluster, and we have been applying updates across the estate. If you are on one of our managed plans and want confirmation of your specific server’s status, ask us and we will tell you exactly where it stands.
If you run an unmanaged VPS with us, patching is yours to do, and this is the week to do it. We are happy to help if you are unsure.
Sources: CISA, NCSC-UK and Help Net Security. Vendor advisories were still being revised at the time of writing, so check the originals for the current position.