PHP2Shell: Critical PHP Vulnerability and What to Do Now

PHP2Shell is the nickname for two critical remote code execution flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. If you run PHP anywhere on the public internet, assume you are exposed today.

Since yesterday afternoon our phone has been glowing red hot. Clients, partners and people we have not heard from in years all ask us the same question: are we hit?

This morning we advised every one of our clients to shut down the applications that run on a vulnerable PHP version until the patch is installed and verified. That advice hurts, and we know it. A website that is offline for a few hours costs money. A server that an attacker controls costs a lot more: your data, your customers’ trust and weeks of cleanup.

Below we explain what is going on, who is affected (more people than you think) and what you should do in the next few hours.

What is PHP2Shell?

The two flaws leaked before a patch existed. The PHP security team rates both 9.2 on CVSS v4.0. Some early reports mentioned a score of 10.0, but Patchstack confirms 9.2 is the official rating.

The disclosure was supposed to happen under embargo. On 20 October a post on Hacker News revealed that the two vulnerabilities existed, and security firm watchTowr then confirmed they are real and reproduced CVE-2026-109618 (Huntress).

According to DutchNews via Ground News, an attacker needs no login to exploit them. Ethical hacker Inti De Ceukelaire told Belga that the weakness lies in how PHP handles files sent to a website, even on sites without an upload form, so many default installations are vulnerable (Brussels Times).

Which PHP versions are affected? PHP has promised to publish the affected and fixed versions together with the patch. CERT-EU and the Australian Cyber Security Centre warn that every version from PHP 5 onward could be affected.

Attacks have already started. Cloudflare reports early attack traffic and has deployed WAF rules, and Patchstack has received reports of active exploitation from several hosting partners.

Timeline of the PHP2Shell leak

All times are as reported, based on Sansec.

Is the PHP patch available yet?

Check the official status on php.net: “Upcoming Critical PHP Security Release”.

At the time of writing, PHP has scheduled the security release for Wednesday 21 October 2026 at 14:00 UTC, which is 16:00 in the Netherlands. The PHP team says it may release earlier if details become public or exploitation shows up in the wild. The full details, affected versions and fixed versions will appear with the release.

Two practical warnings for when the patch lands:

• Your operating system packages, Docker base images and hosting control panels will lag behind php.net, sometimes by hours. The PHP Foundation already warned that Remi’s repository, which many Red Hat, AlmaLinux and Rocky Linux servers use, will not publish updates today.
• Updating WordPress, Laravel or your plugins does not fix this. Wordfence points out that WordPress automatic updates will not apply the fix, because PHP runs underneath the application. Find out who is responsible for the PHP version on each server (Reuters via MarketScreener).

Every PHP framework and CMS is in scope

The flaws live in the PHP interpreter, so every application running on a vulnerable PHP version inherits them. Your code can be perfect and your plugins fully up to date, and you are still exposed. PHP, or software built on it, powers roughly 70 percent of all websites according to the Dutch NCSC (NL Times).

That covers WordPress and WooCommerce with every plugin and theme on top of them. It covers applications built with Laravel, Symfony, CodeIgniter, CakePHP and Yii. It covers CMS platforms such as Drupal, Joomla, TYPO3 and Craft CMS, and webshops running Magento, Shopware or PrestaShop. And it covers every custom PHP application, API and customer portal your organisation ever had built.

If a developer once built “a small PHP script” for your contact form or a price calculator years ago, that script counts too.

No PHP application of your own? You can still be hit

This is the call we make most often today. Many organisations tell us they have no PHP because they never built a website in it. Then we look at the tools that keep the business running, and PHP turns up everywhere.

Your webmail is a good example. If your team reads email through Roundcube, that webmail runs on PHP and faces the internet by design. The same goes for Nextcloud, where your shared files and calendars live.

Other common candidates are phpMyAdmin, Moodle, Matomo, MediaWiki, GLPI, osTicket, Mautic and SuiteCRM. Intranets, booking systems, ticket desks and supplier portals that someone set up years ago often run on PHP as well.

So assess the supporting tools, and include the ones a supplier or hosting party manages for you. The University of Vienna, for example, took its potentially exposed systems off the network, and that included webmail (Pasquale Pillitteri). Inti De Ceukelaire also warned that the risk reaches beyond sites written in PHP, and he took his own personal websites offline for the first time ever (Brussels Times).

Governments are taking systems offline too

If shutting down feels extreme, look at what governments did today. CERT-EU, the EU’s own cybersecurity team, told organisations that cannot patch to take affected websites offline. Cybersecurity agencies in Europe, Australia, Japan and the UK gave the same advice: update immediately or go offline until you can.

The Dutch NCSC put it plainly: until PHP releases its updates, any system with PHP that is reachable from the public internet is likely vulnerable. When the organisation that issues the warnings takes its own website offline, you know the risk is real.

What to do about PHP2Shell in the next few hours

1. Make a list of every system that runs PHP, including webmail, file sharing, intranet tools and anything your hosting party or suppliers manage for you.
2. Take public-facing PHP applications offline, or put them behind a VPN or IP allowlist, until they are patched.
3. Turn on WAF protection (Cloudflare, your host’s firewall or a ModSecurity ruleset) where you truly cannot go offline, and treat it as a stopgap until you patch.
4. Install the PHP update as soon as it reaches your platform, and confirm the new version with php -v or a phpinfo check on every server and container.
5. Check for signs of compromise after patching: unknown PHP files in web folders, new admin accounts, changed cron jobs and unusual outbound traffic since 20 October.
6. Ask every supplier and hosting party for written confirmation that they patched the PHP behind your services, and note the date and version.
7. Rotate passwords, API keys and database credentials on any system where you find something suspicious.

Not sure where to start, or no idea which of your tools run on PHP? Call us. Yes, the phone is glowing, and we will still pick up.

If you want to know how we work with PHP teams, see our pages on hiring a PHP developer and hiring a Laravel developer, or get in touch directly.

Sources

• PHP: Upcoming Critical PHP Security Release
• Huntress: php2shell, leaked critical PHP vulnerabilities
• Patchstack: PHP vulnerable to critical RCE, attacks ongoing
• Sansec: Critical PHP RCE, CVE-2026-109618 and CVE-2026-109619
• Reuters via MarketScreener: Government websites go dark
• Bloomberg: Governments take websites offline after PHP security warnings
• NL Times: Dutch parliament website taken offline
• Yle: Finland temporarily shuts down government websites
• Brussels Times: Major websites go offline
• DutchNews via Ground News: Government websites taken offline
• Pasquale Pillitteri: Netherlands and Finland switch off government sites

Frequently asked questions