If a website you use runs on PHP, and a lot of the web does, its owners were told on 21 October to drop everything. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert titled "Critical Vulnerabilities in PHP Require Immediate Patching" for two flaws nicknamed PHP2Shell, and told organisations to patch immediately or take affected systems offline.
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. In plain terms, an attacker who doesn't need to log in could run their own code on a server. CISA says they affect PHP installations serving web requests, across common setups including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
What's been fixed, and who found it
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. BleepingComputer, reporting on 21 October, says PHP also published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source, since PHP 8.1 and older no longer get official updates.
According to BleepingComputer, the bugs were found by security researchers from Calif, OpenAI and Wiz, and both stem from PHP leaving memory corrupted when a request ends abnormally. The PHP team said the risk is highest for mod_php, where "a demonstrated exploit" can be triggered before any application code runs.
How worried should anyone be? At publication, CISA said it had "not observed successful exploitation of these vulnerabilities in the wild." BleepingComputer adds a more urgent note: Cloudflare said it was already seeing early attacks against both flaws before the patches shipped. The UK's National Cyber Security Centre also urged organisations to update immediately or take systems offline.
CISA's advice
CISA's alert is unusually blunt. Its recommendations:
- Find every PHP system, including PHP embedded inside other software.
- Patch immediately, starting with anything facing the internet.
- Take systems offline if they can't be updated straight away, or if they run PHP 8.1 or older, which is no longer supported.
- Use a web application firewall for some protection until patching is done.
- Watch for warning signs, such as PHP worker processes launching shells or downloading tools.
PHP has also listed stopgap settings for anyone who can't patch yet. BleepingComputer is clear, though, that the PHP team says these "don't fully protect against exploitation". The only real fix is the update.
Why it matters if you don't run a server
Most people reading this won't patch anything themselves. But PHP sits underneath a huge number of everyday websites, from shops and forums to community and game sites, so a flaw like this is a risk to the people using those sites too. A compromised server can leak account details or serve malicious content without anyone noticing.
The practical advice for users is short. If a site you rely on goes offline for a few hours this week, that may well be its owners following CISA's guidance, which is a good sign. Use unique passwords, so a breach on one site doesn't unlock others. And if you run a site, even a small one on shared hosting, check your PHP version today, or ask your host whether they've updated.
What happens next is mostly in the hands of site owners. Patches are available. The open question is how quickly the long tail of unmaintained and older PHP installations gets updated, and neither CISA nor PHP has given a figure for how many remain exposed.
Reporting notes