22 Oct

Attention Website Owners! PHP2Shell Critical Security Vulnerability

Attention Website Owners!

PHP2Shell - Critical Security Vulnerability

Websites Using PHP Should Check and Update Immediately

On 21 October 2026, the official PHP project released an emergency security update patching two critical vulnerabilities collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both vulnerabilities have a CVSS v4.0 score of 9.2 (Critical).

What is PHP2Shell?

PHP is the programming language used by many websites and online systems, including quite a few WordPress, Drupal, Joomla and custom PHP sites. This vulnerability lies in the PHP runtime itself, not in any single plugin or theme. Attackers may be able to execute code on affected servers through specially crafted network requests without logging in, leading to website compromise, data leakage or service disruption.

Which websites need attention?

If your website is running an unpatched version of PHP, you should check it as soon as possible. The official PHP project has released the following patched versions:

PHP 8.5:	8.5.12 or later
PHP 8.4:	8.4.27 or later
PHP 8.3:	8.3.36 or later
PHP 8.2:	8.2.35 or later

PHP 8.1 and older versions that are officially end-of-life may also be affected; migrating to a supported version as soon as possible is recommended. Some Linux distributions or hosting providers backport security fixes to their existing packages, so the version number alone is not conclusive — you should verify the actual patch status with your provider.

What should website owners do now?

1	Check the PHP version: Confirm the PHP runtime and patch status actually in use across your website, APIs, servers and containers.
2	Update as soon as possible: After completing backups and the necessary compatibility checks, install the security patch provided by the official source or your system provider, restart the relevant PHP services, and confirm the new version is in effect.
3	Check for unusual activity: Watch website error logs, unusual logins or traffic, suspicious files and other possible signs of compromise. If you suspect a breach, preserve the records and seek professional assistance.

Unable to update yet? Restrict external access as a priority and, if necessary, suspend the affected service. A web application firewall (WAF) can provide additional protection, but it cannot fully replace a PHP security update.

Users of WordPress or website hosting services should note: Updating WordPress, plugins or website code does not mean PHP on the server has been updated. If your website is managed by a development company or hosting provider, confirm the patch status with them as soon as possible.

Important reminder: Running an affected version does not mean your website has been compromised, but because the vulnerability can cause serious risk, you should act early.

For further information, please refer to the official PHP security announcement.

What's New

Attention Website Owners! PHP2Shell Critical Security Vulnerability