Does Your Website Run PHP? Update Today or Risk an Attack

Critical alert · updated 21 October 2026. PHP has released the patch: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploitation is active and, now that the fixed code is public, automated attacks are ramping up. If you run PHP exposed to the internet, update today.

They are called PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (critical). They let an attacker with no credentials run code on the server through HTTP requests. Your application doesn't need to have any bug: the problem is in PHP itself, and on Apache with mod_php the attack has been demonstrated before a single line of your application runs.

Latest updates

We update this section as news comes in. Times in UTC.

21 Oct, 14:45 UTC · Fixed packages are out for Ubuntu and Debian.

Ubuntu (USN-8948-1): 26.04 LTS with php8.5 8.5.4-0ubuntu1.5, 24.04 LTS with php8.3 8.3.6-0ubuntu0.24.04.13 and 22.04 LTS with php8.1 8.1.2-1ubuntu2.28. Releases 20.04 and older are still "needs evaluation".
Debian (DSA-6574-1): trixie with php8.4 8.4.27-1~deb13u1. No advisory yet for bookworm (php8.2).
Ondřej Surý's repository (sury.org, widely used on Debian and Ubuntu): the maintainer confirms fixes for every branch in the repository, including end-of-life ones, and users are already receiving packages back to PHP 5.6 on amd64. ARM builds and the Ubuntu PPA are lagging behind.
Red Hat: at the time of writing we found no advisory or packages. Remi will not have updates today.
Note on the PHP 7.4, 8.0 and 8.1 fixes published by PHP: they are not new versions you download from php.net, but minimal source patches meant for people who build PHP themselves and for extended-support vendors. They are on GitHub: PHP 7.4 · PHP 8.0 · PHP 8.1. If you don't compile, your route is your distribution's or vendor's package.
CERT-FR (CERTFR-2026-ALE-014) confirms that disabling session.upload_progress only reduces the attack surface of one of the two vulnerabilities. It recommends blocking multipart requests (or monitoring them if blocking isn't possible) and isolating servers on unsupported branches now.

Why this one is serious

Details leaked before the patch. PHP had to bring the notice forward to 20 October and the release to the 21st.
It is already being exploited. Cloudflare saw the first attacks at 07:43 UTC on 21 October, hours before the patch, and Aikido confirmed real exploitation that same morning.
It affects almost everything. The official advisory treats any version before the fixed ones as vulnerable. That includes WordPress, WooCommerce, Magento, Shopware, Laravel, Drupal, PrestaShop and any PHP website or panel.
The flaw is now public. With the fixed code published, anyone can see exactly what was changed. Sansec expected mass scanning within minutes of the release.
Organisations are switching services off. In the Netherlands, Tweakers, the Tweede Kamer and the NCSC took websites offline as a precaution.

Is your server affected?

Your PHP version	What to install
8.5	8.5.12 or later
8.4	8.4.27 or later
8.3	8.3.36 or later
8.2	8.2.35 or later (end of life on 31 Dec 2026)
8.1 · 8.0 · 7.4	No official release. Your distribution's or LTS vendor's fixed package, or build from the source backports PHP has published on GitHub (PHP 7.4 · PHP 8.0 · PHP 8.1). And plan a move to 8.2+.
7.3 and older	No public fix. Isolate the server and migrate.

Risk is highest on Apache with mod_php, where PHP demonstrated full exploitation. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected too.

What to do today, in this order

Take inventory now. List every server, hosting account and container running PHP reachable from the internet, including forgotten admin panels and old websites.
Update. Install the fixed release for your branch or your distribution's updated package (they received the patch in advance). If you rely on the Remi repository, PHP warns it won't have updates today: switch to distribution packages or build from source.
Restart PHP-FPM or Apache. Without a restart the vulnerable binary keeps running. The same goes for Octane, queue workers and any long-running PHP process.
Check the version your website actually serves, not the terminal one: php -v can show a different version from the one Apache or FPM uses.
If you can't update today, apply the interim mitigations from the official advisory. We explain them step by step, with copy-paste configuration, in PHP2Shell: how to mitigate it if you can't update yet (in Spanish; the config blocks work as-is). And switch off anything non-essential.
Check whether you've already been breached. Exploitation started before the patch: look for new or modified PHP files, web shells, new admin users and unusual outbound connections.

On shared hosting? Email your provider today and ask which PHP version serves your site and when they will apply the patch. Don't assume they'll do it on their own.

Frequently asked questions

Which PHP version fixes PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Any earlier version is vulnerable. For PHP 7.4, 8.0 and 8.1 the PHP team published source backports, and Linux distributions and LTS vendors received the patches in advance.

Is my server vulnerable to PHP2Shell?

If it serves PHP over the web and isn't on one of the fixed versions, yes. It affects Apache with mod_php (the most serious case, with exploitation demonstrated before any application code runs), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

What should I do if I can't update today?

Apply the interim mitigations from the official advisory: memory_limit=-1 enforced by the administrator, request size limits, session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, restarting every worker. Block multipart/form-data at the web server if the application doesn't use it. None of them replaces updating.

Sources:

Hourly consulting

Want us to review and secure your environment?

We check your PHP servers, apply the patch or the mitigations and verify nobody got in. Leave your phone or email and we'll contact you today.

We'll only use it to contact you about this request. Privacy policy.