PHP2Shell: two critical PHP vulnerabilities – update now
Published 21.10.2026 · Severity level : Critical · Updated 27.10.2026
What is happening: On October 21, 2026, PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell.” Both can enable remote code execution on the server without logging in. The first affects memory shortage handling, while the second involves internal data that a later request can use after memory has been freed.
How serious is it: Critical. Examples of attack code have been made public, and CERT-FR has observed attack attempts (October 27, 2026). Both vulnerabilities are on the US CISA list of vulnerabilities that are being actively exploited.
Who is affected: All websites running PHP – including WordPress, Joomla, Drupal and many webshops – using PHP 5.x, 7.x, 8.0, 8.1, or 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. PHP 5, 7, 8.0 and 8.1 no longer receive updates.
What you should do: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Ask your provider which PHP version your website uses. If it runs on a version that no longer receives updates, it must be migrated to a maintained version. Temporary measures are available, but according to PHP, they do not make an installation safe; only the update does.
See also CVE-2026-115560, a new vulnerability in the same area that has not yet been fixed. Are you unsure about your website? Contact us, and we will tell you what should be done.