The PHP project has released emergency security updates for two critical vulnerabilities in the PHP engine, together nicknamed PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, each carries a CVSS v4.0 score of 9.2 and can, under the right conditions, let an attacker who has not logged in run code with the privileges of the PHP worker process.
Fixed versions — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — went out on October 21, a day earlier than planned, after technical details leaked ahead of the coordinated disclosure. The flaws affect PHP installations that handle web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Reports differ on exactly how far back the bugs reach, but researchers agree that many years of releases are affected.
How much damage is being done is still unclear. Security firms including watchTowr and Aikido say they have seen exploitation attempts in the wild, while The Hacker News reported early attempts but no confirmed breaches. Arctic Wolf cautioned that a successful attack also depends on conditions inside the specific application.
What to do
Update PHP to a fixed release now. A widely shared stopgap, turning off session upload progress, was never a complete fix, according to the PHP release notes. Customers on managed hosting should confirm with their provider which PHP version their sites run. Searchlight Cyber has published an open-source tool, php2shell-scanner, that checks whether a host is exposed.
Sources: Help Net Security, SecurityWeek, The Hacker News.
Image: illustration created for AABEAT TV. It does not depict the people, places or products named in this story.
