Blog
PHP2Shell: critical PHP vulnerabilities and what to do now
On 21 October 2026 the PHP project released urgent updates for two critical vulnerabilities, known as “PHP2Shell”, that allow an attacker to run code on a server without logging in. Spain’s national cybersecurity CERT (INCIBE-CERT) issued a critical advisory. If your website, online shop or application uses PHP, this affects you.
What happened
PHP has fixed two serious flaws in parts used in almost every request: memory management and error handling.
- CVE-2026-109618: if a request hits PHP’s memory limit at exactly the right moment, half-initialised internal data can be left behind and corrupt memory. On Apache with mod_php it can be triggered without authentication, even before the application code runs.
- CVE-2026-109619: a fatal error at the right moment can leave references to memory from a previous request, which another request can reuse.
Both score 9.2 out of 10 (CVSS 4.0) and can allow remote code execution: that is, an attacker taking control of the server.
Fixed versions
The versions that fix both flaws are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Unsupported branches (8.1 and older) receive no official releases. If your server uses one of them, the recommendation is to migrate to a supported version as soon as possible.
Am I affected?
If your website, online shop (WordPress, WooCommerce, PrestaShop…), ERP or application runs on PHP older than the fixed versions, yes. The risk is higher on servers with Apache and mod_php, but code execution has also been confirmed on PHP-FPM through the code of some applications. Several security firms have reported exploitation attempts, so it is worth acting now.
What to do today
- Check your PHP version: in your hosting panel, in the WordPress Site Health tool or with
php -von the server. - Update to the fixed version of your branch (or to a supported branch) and restart the web service or PHP-FPM.
- If your website is on shared hosting, ask your provider whether the update has already been applied and when.
- Review the logs from recent days for memory errors or unusual process crashes.
- Secure your backups before and after updating.
Disabling the session.upload_progress.enabled option reduces part of the risk from one of the flaws, but does not replace updating: it is the only complete fix.
A lesson for every company
An up-to-date server does not maintain itself. Critical vulnerabilities appear without warning and patches must be applied within hours, not weeks. That is why preventive IT maintenance and server monitoring are the foundation of any company’s cybersecurity. Read also what is happening with Synology NAS and SonicWall VPNs.
Want us to review and update your servers today?
Ciberseguridad esencial