On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities, known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 and let an attacker run commands on a web server with a single request, without logging in.
On October 26, CISA added both flaws to its Known Exploited Vulnerabilities catalog, confirming attacks are underway. Researchers have tracked more than 50,000 exploit attempts from over 600 addresses in 70 countries.
PHP sits underneath a large share of the web, including WordPress, Drupal, and Joomla sites, customer portals, and the web management pages built into some firewalls and other network appliances. Because the flaws are in PHP itself, a site can be vulnerable even if its own code is secure. Nearly every PHP version back to 5.4 is affected.
The fix is to update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP 8.1 and older no longer receive official updates, so systems still running them need an upgrade plan, not just a patch. If your website is hosted, ask your provider to confirm the update. If an appliance runs PHP, check that vendor’s advisory.
As an independent, vendor neutral advisory firm, CommteX Technology Advisors, LLC offers a cost free review to find where PHP is running in your environment and confirm what has been patched, then connect you with the right partner for any remediation.
Contact CommteX Technology Advisors, LLC for your free PHP2Shell exposure review.