PHP2Shell flaws prompt emergency updates and site downtime for web admins

Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider taking services offline.

Threat Times Intrusion DeskOctober 21, 20262 min read

Share LinkedIn Reddit

PHP2Shell flaws prompt emergency updates and site downtime for web admins — Illustration: Threat Times

Key points

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, could let attackers run malicious code on servers without logging in.
The PHP team released emergency fixes for versions 8.2 through 8.5 on October 21 to address the PHP2Shell vulnerabilities.
Cloudflare reported early attacks emerging, prompting warnings to isolate internet-facing applications until patches are applied.

Administrators are taking websites offline to address two critical PHP vulnerabilities that could let attackers run malicious code on servers without logging in. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 out of 10 and have triggered emergency security updates across the web.

The PHP team released fixes on October 21 for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These updates address the PHP2Shell vulnerabilities, which can be exploited before a website’s own code runs in some configurations. The PHP project states that all installations serving web requests are at risk, urging users to update immediately.

Context and Background

PHP powers a large portion of the web, including WordPress, Drupal, Joomla, and Magento. Successful exploitation could let an attacker run malicious code with the permissions of the PHP process. This could potentially allow attackers to steal application data, alter website content, or establish backdoors.

Cloudflare chief technology officer Dane Knecht reported early attacks emerging from these vulnerabilities. He warned that firewall mitigations are only a stopgap measure. CERT-EU recommends identifying PHP-based applications and patching them as soon as possible to prevent unauthorized access.

Who Is Affected

Website owners may encounter temporary downtime as administrators install updates and check their systems. This maintenance mode is a security precaution rather than proof of a breach. However, consumers should remain cautious, as compromised sites may no longer be trustworthy.

Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, noted that hackers can hijack real websites to leverage their reputation for phishing or serving malware. He described the situation as a goldmine for attackers due to the endless opportunities for abuse.

What should you do?

Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages. The PHP team urges immediate action to apply the fixes. Users of PHP 8.1 and older should verify if their vendor supplies a fix, as those versions no longer receive routine updates.

CERT-EU advises considering the isolation of internet-facing applications from public networks if an immediate fix is not feasible. This helps protect vulnerable installations while patches are being deployed.

What to do and how to stay safe: PHP

Verify your PHP version and apply the latest security updates provided by your vendor or hosting provider immediately.
Monitor websites for unexpected content, downloads, redirects, or repeated login requests that may indicate compromise.
Isolate internet-facing applications from public networks if you cannot patch them right away to reduce exposure.
Contact organizations through trusted channels if a familiar website behaves strangely or requests unusual actions.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.