PHP2Shell: the two PHP flaws fixed on 21 October 2026

A small website runs on software that sits on a server, out of sight of the people who visit it.

PHP is one kind of that software. The PHP project says PHP powers "everything from your blog to the most popular websites in the world".

On 21 October 2026 the PHP project fixed two serious flaws in it.

What the flaws are

The flaws are known as PHP2Shell. Their official names are CVE-2026-109618 and CVE-2026-109619.

The PHP project published its security advisory on 21 October 2026. It said the flaws "can allow unauthenticated remote code execution". That means someone with no login could make the server run their own commands.

The PHP project rated both flaws 9.2 out of 10.

Whether your site is affected

The PHP project says the people at risk are "all PHP installations serving web requests". The advisory lists the usual ways of running PHP on a web server, including PHP-FPM and Apache with mod_php.

A site that runs on PHP needs the fixed version. Sansec, a security firm, says online shops built on Magento, Shopware and WooCommerce are affected even when their own code is clean.

The UK's National Cyber Security Centre (NCSC) said organisations using any version of PHP are affected. It asked them to update to the latest fixed version.

The fixed versions

The PHP project released fixes in four versions on 21 October 2026.

PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and long-term support vendors have made their own fixes for older versions.

PHP 8.2 gets security fixes from the PHP project until 31 December 2026.

What to ask your host or developer

If a hosting company or a developer looks after your site's server, they are the people who can update PHP.

The NCSC's advice is to update first. Where that is not possible, it points to the temporary measures in the PHP project's advisory. Where neither is possible, it says organisations should consider taking the system offline until it is fixed.

The NCSC also says that a system which could not be updated straight away should be checked for signs that an attacker got in.

How serious it has been so far

The US Cybersecurity and Infrastructure Security Agency added both flaws to its list of known exploited vulnerabilities on 26 October 2026.

Some security firms have since reported a calmer picture. Sansec's research page, dated 21 October, says an attack "needs specific knowledge of the target server and specific conditions on it". It says mass exploitation is less likely than it first expected.

Arctic Wolf said on 22 October that early exploitation had been "more limited than the initial attention suggested".

Both firms still advise updating PHP.

Useful links