PHP2Shell: Two Critical PHP Flaws Put Millions of Websites at Risk
❓What:
PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Public reporting calls the vulnerabilities PHP2Shell. patchstacksecurityweek
They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates both Critical (CVSS v4.0 9.2). patchstack
Details leaked online on October 20, before coordinated disclosure and before patches were available. PHP moved the release up from October 22 in response. huntressrescana
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix both flaws. huntress
watchTowr reports seeing exploitation in the wild as of October 21 through its global honeypot network. watchtowr
⚠️Impact:
According to PHP, every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. huntress
Researchers showed unauthenticated code execution against current WordPress, Drupal and Joomla container images, and say even a basic “Hello World” app on a vulnerable version can be exploited. patchstack
Only the four supported branches, 8.2 through 8.5, can receive the fix. Older PHP versions get no patch. thehackernews
Patient portals, school websites, client portals, and vendor-hosted sites built on PHP are all in scope.
💡Recommendations:
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now, then restart PHP services so the fix actually loads.
Inventory every system running PHP, including WordPress, Drupal, and Joomla sites.
Ask your web host, managed WordPress provider, and key vendors whether they have patched.
Prioritize replacing anything running PHP older than 8.2.
Watch web server logs and endpoint alerts for unusual processes spawned by the web server.
Read the full story HERE