PHP2Shell Emergency Patch Released as CISA Urges Immediate Fixes for Two Critical 9.2 Flaws

Two flaws in the language behind most websites can let attackers run code without logging in — and the fix cannot wait for a routine update window

October 21, 2026 — The PHP project released an emergency security patch on October 21 for two critical remote code execution flaws, both rated CVSS v4.0 9.2, as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organisations to patch immediately. Researchers have nicknamed the pair PHP2Shell. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Image: Web server protected by a warning shield and padlock as firewall defences block attacks exploiting critical PHP flaws. Credit: AI-generated illustration / Red Eye Eagle News.

Editor's Highlight: This is not a bug in one app. It is a bug in the PHP interpreter itself, which means the flaw can trigger before WordPress, Drupal or any other application code even runs — and updating WordPress alone does not fix it.

Table of Contents

• What PHP2Shell Actually Is
• Why the Patch Arrived Early
• Who Is Exposed, and the End-of-Life Problem
• What Site Owners Should Do Today
• Bottom Line
• FAQ
• Sources

Key Facts

Flaws	CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell
Severity	Both CVSS v4.0 9.2, critical, unauthenticated remote code execution
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Patch date	October 21, 2026, released ahead of the planned 14:00 UTC slot
At-risk setups	All PHP installations serving web requests, including PHP-FPM and Apache mod_php
Older versions	PHP 7.4, 8.0 and 8.1 get source backports only; upgrade to 8.2 or newer advised
Official advice	CISA: patch immediately; CERT-EU and UK NCSC: isolate or take offline if you cannot

What PHP2Shell Actually Is

PHP is the programming language behind a large share of the web. According to SC Media, nearly 70% of websites run PHP-scripted applications, and WordPress alone powered more than 40 percent of the internet in 2025 figures cited by Huntress.

The two flaws work differently. CVE-2026-109618 involves out-of-memory corruption: when PHP runs out of memory handling a request, it can treat half-built internal data as valid during cleanup.

CVE-2026-109619 involves stale state between requests: data from one request can outlive its memory, and a later request on the same worker can pick it up before reset.

Tech Analysis: Both paths end in the same place — an attacker who needs no login can potentially run their own code on the server, alter websites or steal data, as watchTowr described the flaws. Because the weakness sits in the interpreter, protections added inside an app sit downstream of the bug.

Why the Patch Arrived Early

The release was not supposed to land this way. PHP gave advance notice on October 20, and the fixes were originally expected on a more orderly schedule — SC Media notes the disclosure came before the originally scheduled patch on October 22.

That plan collapsed when details leaked. Roman Y. Sannikov of iCounter said the CVE IDs were posted on Hacker News before patches shipped, watchTowr had reproduced one flaw, and Cloudflare was seeing early attacks.

Date	Event
October 20, 2026	PHP gives advance notice; flaw details leak online
October 21, morning	Early attack attempts and scanning reported
October 21, 2026	Emergency fixed releases published ahead of 14:00 UTC plan
October 21, 2026	CISA, CERT-EU and UK NCSC urge immediate patching or isolation

Cloudflare chief technology officer Dane Knecht stressed that its firewall work was temporary. “This is a STOPGAP only. Patch as soon as PHP releases the update,” he wrote, according to reporting on the incident. Government sites in the Netherlands and Finland went offline as a precaution.

Who Is Exposed, and the End-of-Life Problem

php.net says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where an attack can run before any application code.

The harder problem is old PHP. Alon Noy of Astelia said roughly 2.2 million hosts advertise PHP, and about 900,000 run end-of-life versions that will not get a standard fix.

PHP line	Fix route
8.5 / 8.4 / 8.3 / 8.2	Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
8.1 / 8.0 / 7.4	Source backport patches only; no new official release
PHP 5 onward (legacy)	Described as potentially affected; isolate and upgrade

Newsroom Focus: Forgotten systems are the worry. As Andrew Obadiaru of Cobalt put it, the real test is whether teams know every place PHP is running — including legacy apps and vendor appliances.

What Site Owners Should Do Today

Start with inventory. Find every PHP installation, then focus first on systems reachable from the internet.

Apply the fixed release for your line. If you run WordPress, remember the warning from Wordfence: automatic WordPress updates do not install the PHP patch. You need whoever manages your server or hosting to apply it.

If you cannot patch, restrict access, isolate the system, or take it offline. A web application firewall can buy time, but it is not a substitute for patching.

Practical Takeaway: Check your PHP version today, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer for your line, rebuild container images from updated official PHP images, and if you are still on PHP 8.1 or older, plan the upgrade to a supported version now — this patch will not be the last one you need.

Bottom Line

PHP2Shell is a patch-now emergency: the flaw is critical, unauthenticated, in the interpreter itself, and already attracting attackers after an early leak. What to watch is how quickly hosts and forgotten legacy servers update — that long tail is where compromises are most likely.

FAQ

What is PHP2Shell?

It is the nickname researchers gave to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 and both capable of remote code execution.

Which PHP versions are fixed?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 7.4, 8.0 and 8.1 have source backport patches, but upgrading to 8.2 or newer is the advised step.

Does updating WordPress fix my site?

No. According to Wordfence, WordPress automatic updates do not apply the PHP fix. The server's PHP version itself must be updated, usually by your host.

What if I cannot patch right away?

Agencies advise isolating affected systems from public networks or taking them offline. Firewall rules are a stopgap only, according to Cloudflare.

Have attacks already started?

Cloudflare reported early attack attempts, and watchTowr said it had reproduced one flaw. Experts expect exploitation attempts to grow after disclosure.

Sources

• SC Media — CISA advises orgs to patch PHP2Shell bugs immediately: https://www.scworld.com/news/cisa-advises-orgs-to-patch-php2shell-bugs-immediately
• The Cryptonomist — PHP critical vulnerabilities threaten websites, immediate patch needed: https://en.cryptonomist.ch/2026/10/21/php-critical-vulnerabilities-patch/
• Wordify — PHP critical security release, October 2026, live updates with fixed versions and flaw details: https://wordify.com/blog/php-security-vulnerability-wordpress-october-2026/
• Image: AI-generated illustration / Red Eye Eagle News (original hero image)