What happened?
On October 21, at around 4 p.m. German time, the PHP project released unscheduled security updates addressing two highly critical vulnerabilities. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. With a severity score of 9.2 on a scale that goes up to 10, these vulnerabilities rank among the most serious. There is nothing ordinary internet users can do about them directly, but operators of vulnerable web servers need to take immediate action.
The vulnerabilities have already been addressed in most major Linux distributions (see list). Web hosting providers and website operators now need to install the updates as quickly as possible.
Originally, details of the vulnerabilities were not supposed to be disclosed until today (October 22). However, because information about the vulnerabilities had already leaked to the public, the PHP project also brought forward the release of the patches.
What exactly is PHP?
Put simply, PHP is a programming language that acts as a link between a website and the systems running behind the scenes. When a user requests a web page or enters information on a website, PHP comes into play to retrieve information from the web server itself or from a database and then make that information available to the user on the website. PHP is used in many well-known systems, from WordPress and TYPO3 to Joomla, Plesk, and numerous e-commerce platforms.
One important distinction: The vulnerability exists in PHP itself, not in any of the systems mentioned above. Even someone who has installed the very latest version of a system such as WordPress may still be vulnerable if the underlying PHP version is outdated.
The vulnerabilities described here allow an ordinary user to gain access to these backend systems without having to authenticate. An attacker can not only access the server's memory, which may contain things such as API keys or passwords, but also potentially steal data or install malware.
Who is affected, and what does it mean for them?
Private users: Anyone who merely visits websites does not need to take any immediate action on their own computer or smartphone. PHP runs on the server, not in the browser. However, it would be premature to give the all-clear. If an online store, forum, or community organization's website is compromised, data stored there could be stolen. And anyone who runs their own blog or small website and manages the underlying CMS themselves is also a website operator – and should therefore take action.
Businesses: For companies, the affected systems may include online stores, customer portals, intranets, and marketing websites. A successful attack could lead to data breaches, website manipulation, malware infections, or provide attackers with a foothold in the internal network. Potential reporting obligations under the GDPR may also apply. Companies that host their websites with an external provider should find out whether the updates have already been installed. Those running their own servers or Docker containers are responsible for updating them themselves. Incidentally, PHP is also used in numerous appliances, such as routers and firewalls, that are managed and configured through a browser-based interface. Updates are important here, too; these are generally provided by the manufacturer.
Public authorities: Government agencies and other public institutions operate numerous PHP-based portals, citizen services, and content management systems. Germany's Federal Office for Information Security (BSI) has issued a level 3 out of 4 cybersecurity warning (orange), while CERT-EU has published its own advisory. Both recommend patching immediately. Where this is not possible, they advise considering temporarily disconnecting affected systems from the internet.
Which versions are affected, and which have been patched?
Affected PHP versions: All versions from 5.4 onward (php-fpm, php-cgi, FrankenPHP, LiteSpeed)
Patched PHP versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35
Older PHP versions: No updates available, only backported patches
Patched Linux distributions and platforms (as of October 22, around 1 p.m. German time):
Debian 12 (DLA-4848-1)
Debian 13 (DSA-6574-1)
Debian unstable
Ubuntu 14.04 through 26.10 (USN-8948-1 / USN-8948-2)
RHEL 8, 9, and 10 (PHP 8.4 on RHEL 9 is still pending)
Rocky Linux 8, 9, and 10
SLES 15 SP7
Alpine Linux edge & 3.24
Plesk (Linux and Windows), cPanel, DirectAdmin, official Docker image
What website operators should do now
Update PHP packages through the control panel, the respective Linux distribution, or the responsible hosting provider.
Restart the web server after installing the updates.
Verify the active PHP version through the web server (simply running
php -vin a shell is not enough!).Rebuild and restart Docker images.
For systems running PHP 8.1 or older: either upgrade to a patched version OR isolate the system and disconnect it from the network.
Check logs for suspicious activity, particularly newly created PHP files, new or unknown administrator accounts, or cron jobs (especially dating back to October 20!).
