PHP2Shell: Critical Vulnerabilities Threaten Websites and Business Applications
Two critical PHP vulnerabilities with a score of 9.2 are threatening web servers. Check the affected versions, security patches, and recommended actions.
Two new critical vulnerabilities in the PHP programming language have triggered security alerts worldwide. European and national institutions are calling for immediate action, as attackers could take control of vulnerable web servers. In Slovenia, the Government Office for Information Security (URSIV) has raised the cyber threat level to high.
At a Glance
- What: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2/10).
- Patched Versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Action Required: Check the PHP version on your servers and install patches as soon as possible.
Why is this Important for Almost Every Online Business?
PHP is one of the most widely used programming languages for powering websites and applications. It is used by numerous systems, ranging from WordPress websites to online stores, user portals, and business applications.
According to data from W3Techs as of October 21, 2026, PHP is used by 69.3% of websites where the server-side programming language can be identified.
This does not mean that nearly 70% of the internet has already been attacked. It does mean, however, that a vulnerability in such a widespread technology can have an extremely large impact on companies and organizations worldwide.
Two Vulnerabilities with a Score of 9.2 out of 10
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are also collectively known as PHP2Shell.
Both carry a critical CVSS score of 9.2/10. They are related to improper memory management in PHP and could, under certain circumstances, allow an attacker to achieve remote code execution (RCE) without prior authentication.
A successful attack could result in unauthorized access to data, website modifications, business disruption, or the takeover of a vulnerable server process.
It is particularly important to note that these are vulnerabilities in PHP itself, not just in a specific plugin or application. Therefore, updating WordPress or its plugins alone is not enough if the server still uses a vulnerable PHP version.
Security Institutions Urge Immediate Action
The severity of the event is confirmed by the responses of national and international institutions.
On October 21, the Slovenian Government Office for Information Security (URSIV) issued a decree on emergency measures due to the PHP vulnerabilities. The threat level for networks and information systems of entities under the Information Security Act (ZInfV-1) was raised to high.
The European CERT-EU and ENISA recommend immediate installation of security patches and prioritization of internet-facing systems.
The American National Security Agency (NSA) also warned organizations to update affected systems. Where an immediate update is not possible, they advise temporarily taking the system offline until the risk can be properly mitigated.
Meanwhile, Cloudflare has confirmed detected attack attempts and implemented additional Web Application Firewall (WAF) rules. These can reduce exposure but do not replace the need for security patches.
Which PHP Versions Need to be Updated?
The PHP development team released security patches on October 21, 2026. For currently supported branches, the following versions have been patched:
| PHP Branch | Patched Version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP versions 8.1 and older no longer receive regular security updates directly from the PHP project. For some legacy systems, specific patches may be available from distribution vendors or long-term support providers, which should be verified for each individual environment.
What Do We Recommend for Businesses?
If your company uses a website, online store, or business application based on PHP, we recommend the following steps:
- Check the PHP version that is actually running each specific website or application. Do not forget old portals, test systems, and third-party applications.
- Install the appropriate security patch. Before upgrading, verify application compatibility and prepare an appropriate backup.
- If an update is not immediately possible, limit exposure. After assessing the business impact, temporarily restrict public access or implement other measures recommended by the vendor.
- Monitor security alerts and logs. Watch for suspicious requests, unusual server behavior, and any signs of unauthorized access.
- Coordinate action with your hosting provider. For managed servers or hosting, it must be clear who is responsible for the PHP update.
You can most often check the PHP version in the hosting control panel (such as cPanel or Plesk), in the Site Health tool in WordPress, or simply by requesting it from your hosting provider or developer.
If you use Cloudflare or another Web Application Firewall, it should remain enabled as an additional layer of protection. This alone does not mean the vulnerability has been resolved.
Web Application Security AuditWhat the audit includes and when it makes sense to perform it.How Can VitaliT Help?
It is not always simple for a company to determine which applications use PHP, whether an update is already installed, or if an upgrade might impact operations.
At VitaliT, we assist with technical audits of web and server environments, checking PHP versions, assessing exposure, and coordinating necessary security measures. Learn more on our Cybersecurity page.
If necessary, we also collaborate with hosting providers and application developers to ensure patches are implemented in a controlled manner and the results are verified.
Official Sources and Additional Information
- Am I at risk if I use WordPress?
- Yes. The vulnerabilities are in PHP itself, not in WordPress or its plugins. If the server is using a vulnerable PHP version, updating WordPress is not sufficient. The PHP version on the server must be checked.
- Is it enough to use Cloudflare or another Web Application Firewall?
- No. Additional WAF rules can reduce exposure but do not replace security patches. PHP must be updated to a patched version.
- Which PHP versions are patched?
- PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Versions 8.1 and older no longer receive regular security updates from the PHP project, so options should be checked with the distribution provider or an upgrade should be planned.
- PHP: Official Security Advisory and Patches
- CERT-EU: Critical Vulnerabilities in PHP, 2026-018
- SI-CERT: Critical Vulnerabilities in PHP
- URSIV: Decree on Emergency Measures
- NSA: PHP Security Advisory
- Cloudflare: Protection against PHP2Shell Vulnerabilities
This article is based on information published and verified on October 21, 2026. Security information may be updated as further research and vendor responses become available.