An update has been issued for two critical PHP (PHP Hypertext Preprocessor) vulnerabilities after a working exploit was published online this week.
PHP is a server-side programming language used in web development, powering millions of websites globally.
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and carry a CVSS score of 9.2, ranking them as ‘critical’. Both enable unauthenticated remote code execution (RCE), according to analysis.
On Monday 20 October, the PHP Foundation issued an advisory warning of the two vulnerabilities, urging organizations to prepare for an impending patch. The advisory was issued following reports that an exploit tool known as ‘PHP2Shell’ has been made available, with a video guide of the tool in action posted online.
In a follow-up announcement, the PHP Foundation said fixes for both flaws are now available, outlining organizations at risk of attack.
“Who is at risk: All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed,” the foundation said.
“We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
How to patch the PHP vulnerabilities
According to the PHP Foundation’s advisory, organizations are required to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Sources for the patches can be found via the foundation’s downloads page.
Linux distributions and LTS vendors were given access to the patches in advance, according to the foundation. Admins are advised to check with their respective vendors for updated packages.
Notably, PHP 8.1 and older versions no longer receive support from the PHP project, the foundation warned. Admins are therefore advised to contact vendors for details on a potential backported fix or to upgrade to a supported version.
PHP flaws had the cyber industry scrambling
A host of security agencies worldwide have issued alerts over the critical vulnerabilities amid warnings that both were being actively exploited.
CERT-EU said the vulnerabilities could affect all versions from PHP 5 onwards, which, given this dates back to 2004, underlines the scale of the potential threat.
This warning was echoed by similar analysis from cybersecurity firm watchTowr.
Crucially, CERT-EU said that if organizations cannot immediately patch, they consider “isolating internet-facing applications from public networks until a fix can be applied”.
The UK’s National Cyber Security Centre (NCSC) gave similar advice for organizations.
“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the agency said in a statement.
Jake Moore, global cybersecurity advisory at ESET, said that given PHP underpins large parts of the web, mass exploitation of the flaws represented a huge threat.
“When vulnerabilities are leaked before their patch is available, it is usually a scramble to do whatever possible to mitigate the damage,” he said.
“But the sheer scale of PHP across the internet makes this far more serious than the usual exploit. A vulnerability in technology used by millions of websites could immediately give cyber criminals an enormous number of potential targets.”
Notably, Moore said the leak gives attackers a “huge head start” and urged businesses to identify vulnerable systems and patch immediately when available.