PHP developers have announced an emergency security update that will close two critical vulnerabilities at once. The release is scheduled for 21 October 2026, 17:00 Kyiv time. Both issues have been rated 9.2 out of 10 on the CVSS 4.0 scale and, according to the researchers, allow an attacker to execute arbitrary code on the server remotely.
The most worrying part is that fixes will be issued only for the 8.2, 8.3, 8.4 and 8.5 branches. There will be no official patch for PHP 8.1, 8.0, any 7.x versions or 5.x, so owners of those servers will need to take action themselves.
Who is at risk
Projects with elevated risk
Anything running on PHP could potentially be affected, but two categories should be checked first. These are bespoke sites and projects built on custom frameworks, and hosting control panels such as cPanel, Plesk or DirectAdmin together with custom billing systems and hosting providers’ control panels.
WordPress sites
WordPress also runs on PHP, so owners of WordPress sites should check their interpreter version. You can see it in the hosting control panel or directly in the WordPress admin: Tools → Site Health → Info → Server.
What is currently known about php2shell
Name and CVE numbers
The researchers at watchTowr have named the vulnerabilities php2shell. They also use the identifiers CVE-2026-109618 and CVE-2026-109619 for them, although those numbers do not appear in the official PHP announcement.
What the developers have not yet disclosed
PHP has promised to describe the exact list of affected versions, the PHP component in which the issue resides, and the attack conditions (whether authentication is required, or whether specific server configuration matters) alongside the release. The developers have not offered a temporary workaround before the patch is released.
Are there already attacks
As of 21 October no exploitation attempts or a public exploit have been recorded. This was reported by watchTowr in their php2shell FAQ, and by the company Huntress.
However, there is no room for complacency. When a previous serious PHP flaw, CVE-2024-4577, was disclosed in June 2024, Akamai observed the first attack attempts against its honeypot servers within a day.
How the information leaked early
Anonymous post and researchers’ confirmation
The details were originally scheduled to be published on 22 October. However, on 20 October an anonymous Hacker News user wrote about two PHP vulnerabilities rated 10 out of 10 that allegedly affect all versions starting from PHP 5, although they provided no evidence. That same day watchTowr confirmed the vulnerabilities are real and under embargo — i.e. an agreement not to disclose details until a fix is available. In the evening PHP issued an announcement and moved the release forward by a day.
What has not been confirmed
The claim that absolutely all versions from PHP 5 are vulnerable has not been officially confirmed. watchTowr note separately that no vendor has verified that range, and the 10 out of 10 rating originates solely from that same anonymous post.
Scale of the problem: how many servers will be left without a patch
Mallory’s data
Mallory calculated that on 20 October approximately 884,000 servers on the internet reported PHP version 8.1 or older in their responses. That is about 59% of the nearly 1.5 million servers that disclose a PHP version at all. A further 740,000 machines report running PHP but hide the version.
Limitations of this estimate
The data were collected using Shodan — a search engine for devices connected to the network. Therefore, it is impossible to tell from these figures how many servers are actually vulnerable, since they only concern the versions that servers themselves report.
Action plan for administrators and site owners
The recommendations below are based on guidance from Huntress and CERT-EU — the cyber incident response team for European Union institutions.
Inventory
The first step is to find every place in your infrastructure where PHP runs. This includes not only websites but also hosting control panels such as cPanel and Plesk, and packaged server software that uses PHP internally.
Update after the release
After 17:00 Kyiv time on 21 October, PHP should be updated to the fixed version, starting with servers that are reachable from the internet. If your site is hosted, check with your provider when they will install the patch. Keep in mind that in Linux distribution packages the fix may appear under a different version number than in the official PHP release.
What to do about older versions
Servers on PHP 8.1 and below should be moved to the 8.2 branch or newer. If that cannot be done quickly, such machines should be removed from public access — for example, placed behind a VPN or put behind a web application firewall (WAF).
Monitoring for suspicious activity
Watch for PHP-FPM, PHP-CGI or web server (Apache) processes launching command shells, interpreters or file download utilities. Such behaviour is unusual for a normal website and may indicate an exploitation attempt.
If there are signs of compromise
If you discover anything suspicious, disconnect the server from the network and preserve the web server and PHP logs. Then search for web shells (files through which an attacker controls the site remotely), new files in the site’s root directory, new scheduled tasks and accounts that did not exist before.
