PHP Security Vulnerabilities: Shocking 22.6 Million Sites at Risk
PHP security vulnerabilities disclosed on October 21, 2026, have put an estimated 22.6 million exposed server instances at risk of complete takeover, through two critical, unauthenticated remote code execution flaws collectively nicknamed PHP2Shell.
What Are the Critical PHP Security Vulnerabilities Disclosed This Week?
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 severity score of 9.2 out of 10, and both allow an attacker to execute code on a server without needing any login credentials at all.
Palo Alto Networks’ Unit 42 threat brief notes that identifiers circulating before the official release had listed a CVSS of 10.0, but the PHP Foundation has confirmed the correct score is 9.2. Even at that slightly lower number, this is about as severe as PHP security vulnerabilities get, unauthenticated remote code execution means an attacker can potentially run their own commands on a vulnerable server simply by sending it a crafted request.
Which PHP Versions and Server Setups Are Affected?
CERT-EU says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php considered the highest-risk configuration by the PHP team.
According to security researcher Wiz, who discovered the flaw, affected versions stretch as far back as PHP 5.4 all the way through PHP 8, though PHP’s own advisory specifically names versions 8.5, 8.4, 8.3, and 8.2 as needing the new patches. Fixed versions were released the same day as disclosure, October 21, 2026, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Sites still running end-of-life PHP branches like 7.4 won’t get an official new release, though the PHP security team did publish minimal source backports for that version.
Is This PHP Security Vulnerability Being Actively Exploited?
The picture here is genuinely mixed depending on which source you check, and that’s worth being upfront about rather than picking one side.
Tenable reports that exploitation attempts began even before the public disclosure, and Cloudflare says it detected early attacks at 07:43 UTC on October 21, several hours before PHP’s official patch release at 14:00 UTC the same day. On the other hand, CISA and the Canadian Centre for Cyber Security both stated in their own October 21 alerts that they had not personally observed exploitation yet. A proof-of-concept exploit has also reportedly been claimed by a user on the X platform, though that specific claim remains unverified.
How Do I Fix These PHP Security Vulnerabilities?
The only complete fix, according to every major security vendor covering this, is updating to the patched PHP version for whichever branch you’re running, there is no safe way to fully neutralize this by configuration changes alone.
If you manage your own server, check your PHP version and upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your current branch. If you’re on managed hosting, check with your provider directly, GoDaddy has confirmed it already patched its Managed WordPress Hosting, but coverage can lag across different hosting types and server distributions. Sansec specifically flagged that servers pulling PHP from Remi’s repository, common on RHEL-based Linux servers, did not have the fix available as of the disclosure date, so don’t assume a routine package update automatically covers you.
What If I Can’t Update PHP Right Away?
If an immediate update isn’t possible, Datadog recommends disabling the session.upload_progress.enabled setting, which blocks the known attack path specifically tied to the second vulnerability, CVE-2026-109619.
This is explicitly described as a partial mitigation, not a full fix, since it doesn’t block every possible attack variant across both vulnerabilities. Datadog also suggests pairing this with memory_limit=-1 at the administrator level, combined with separate request-size limits enforced at your frontend and memory limits on the container level, as additional defense-in-depth measures while you work toward a full update. One detail worth knowing if you run WordPress specifically, these PHP security vulnerabilities sit in PHP itself, not in WordPress code, so updating WordPress core, themes, or plugins will not protect you, only a PHP version update does. For more technology and cybersecurity coverage, check out our Technology section.
Frequently Asked Questions
What does the name PHP2Shell actually refer to?
PHP2Shell is the nickname security researchers gave to the combination of CVE-2026-109618 and CVE-2026-109619, reflecting how the flaws can lead to full remote shell access on a vulnerable server.
Does this affect shared hosting customers too?
Potentially yes, since exposure depends on the server’s PHP version rather than your specific hosting plan, which is why checking with your hosting provider directly is important rather than assuming shared hosting is automatically protected.
Is there a way to check if my own site’s PHP version is affected?
Yes, many hosting control panels show your current PHP version directly, or a developer can check server response headers, and you can compare that version against the patched releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) to see if an update is needed.
Why did some early reports say this vulnerability scored a perfect 10.0?
Identifiers that circulated before the official disclosure listed a CVSS score of 10.0, but the PHP Foundation has since confirmed the correct, official score is 9.2.
Will I need to restart anything after updating my PHP version?
Yes, most server setups require a restart of the PHP service, PHP-FPM pool, or web server itself after a version update for the new, patched code to actually take effect, simply updating the package isn’t always enough on its own.