PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now

Published28 October 2026
7 min read

Contents8

Key takeaways

In October 2026 two critical PHP vulnerabilities, known together as "PHP2shell", were fixed. An attacker can run code on your server without logging in.
If you run PHP, update to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later). That is the real fix.
PHP 8.1 and older get no regular fix. Put temporary protections in place and plan an upgrade.
Even if the original developer is gone, the source code on your server is enough to work from.

In October 2026, two critical vulnerabilities were found in PHP, the language behind a large share of websites and business systems. The short answer: if you run PHP, update it to a fixed release.

If your system is on an old PHP version that cannot simply be updated, put temporary protections in place and plan an upgrade soon. This guide is for business owners and managers who are not IT specialists: what happened, what to check today and what to ask your developer or hosting provider.

What happened: the PHP2shell vulnerabilities

On 21 October 2026 the PHP project released fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Used together, they are known as PHP2shell.

9.2/10

Severity (CVSS v4.0), the "critical" band

Vulnerabilities chained in the attack

≤ 8.1

Versions with no regular fix

CVSS is the standard 0-10 scale for rating how severe a vulnerability is. A score of 9.2 is in the highest, "critical" band.

October 2026 at a glance

21 October
PHP releases the fixes
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close both vulnerabilities.
22 October
Japanese security alerts
IPA (Information-technology Promotion Agency) and JPCERT/CC urge everyone to apply the fix.
23 October
A related issue is announced
CVE-2026-115560 has no fix yet; a configuration change is recommended instead (see below).
26 October
Confirmed exploitation
The US agency CISA adds both vulnerabilities to its catalogue of known exploited vulnerabilities.
27 October
No known damage in Japan yet
IPA says it is not aware of any incidents in Japan so far.

The Japanese government's National Cybersecurity Office also urged everyone to apply the fix as quickly as possible, suggesting a temporary shutdown of websites that could not be patched. Several large Japanese online services paused for emergency maintenance.

Not a legal requirement, but…

These are advisories, not legal obligations. The risk to your business and your customers is real, though, so we strongly recommend acting now.

What can an attacker do?

What makes PHP2shell dangerous is that it works without logging in, straight from the internet. In simplified form, an attack looks like this:

1Scan for targetsAutomated tools look for vulnerable sites

2Crafted requestNo login needed

3Code runs on your serverThe attacker's program executes

4DamageDefacement, data theft

Figure 1: how PHP2shell reaches a server (simplified)

Run their own code

An attacker can make your server run a program they sent.

Deface your website

Pages or content you never wrote can appear on your site.

Steal customer data

Enquiries, member records and other data on the server are at risk.

Small company sites are targets too

Most attacks are automated scans looking for any vulnerable server. Company size and fame make no difference.

Am I affected?

Not sure whether you use PHP? You probably do if any of these apply:

Your website is built with WordPress (WordPress runs on PHP).
Your site or contact form runs on shared or rented hosting.
An agency built you a booking, ordering or membership system.
Your system documentation mentions Laravel or CakePHP.

How to check your PHP version

WordPress

Tools → Site Health → Info → Server shows the PHP version.

Hosting

Your hosting control panel usually has a "PHP version" setting. Read your provider's notices too.

Custom systems

Ask your developer or maintenance company for the PHP version and how they are handling PHP2shell.

Fixed versions

Current PHP	What to do	Supported until
PHP 8.5	Update to 8.5.12 or later	31 Dec 2029
PHP 8.4	Update to 8.4.27 or later	31 Dec 2028
PHP 8.3	Update to 8.3.36 or later	31 Dec 2027
PHP 8.2	Update to 8.2.35 or later	Ends 31 Dec 2026
PHP 8.1 or older (7.4, 7.x, 5.x)	No regular fixed release. Mitigate now and plan an upgrade	End of life

Don't rely on the version number alone

Linux distributions such as Red Hat may ship their own patched packages. Confirm with your developer or hosting provider.

What to do today

List your PHP systems
Website, forms, internal tools: write down everything you can think of.
Contact whoever maintains them
Ask: "How are you handling the PHP2shell vulnerabilities?"
Have PHP updated
Ask for the update to be tested in a staging environment before it goes live.
If you cannot update yet, mitigate
Restrict admin pages to your office network, switch off unused systems, or take the site offline temporarily.
Check for signs of attack
JPCERT/CC recommends reviewing the server logs for PHP workers crashing repeatedly, suspicious files and unusual outbound traffic.

Also: the related issue CVE-2026-115560

Announced on 23 October, it has no fix yet. The PHP team recommends setting session.upload_progress.enabled=0 in the meantime. Mention it to your developer as well.

If you are still on PHP 7.4 or 5.x

This is the hardest case. PHP 8.1 and older no longer receive regular updates.

The PHP team has published minimal source backports for 7.4, 8.0 and 8.1, but applying them means building PHP yourself, which is specialist work.
Research cited by IPA says PHP 5.4 and later are affected by at least one of the two flaws.

IPA advises restricting access or suspending the service if patching is not possible, and in the longer term reviewing whether the system is still needed, whether it can be replaced and whether you have the budget and people to keep maintaining it.

Leave old PHP as it is

Stays a target for automated scans
Defacement and data theft remain possible
The next vulnerability can't be fixed either
You end up reacting in a hurry

Act now

Temporary protections cut the risk right away
On PHP 8 you receive fixed releases again
Future vulnerabilities become routine updates
You decide the budget and the timing

In practice, an old PHP system will need an upgrade to PHP 8, whatever stopgap you use now. See PHP upgrade cost and process for what that involves.

No one to ask?

We often hear:

The company that built it has disappeared.
There is no documentation.
The person who knew the system has left.

Don't give up. The source code on your server still tells us exactly how the system works. Read taking over a system with no documentation to see how a handover works.

FAQ

Would attackers bother with a small company website?

Yes. Most attacks are automated scans looking for any vulnerable server, regardless of company size.

My host manages the server. Am I covered?

Often, but not if your account is pinned to an old PHP version in the control panel. Check your provider's notices and the version you have selected.

Will updating PHP break my site?

Updates within the same branch (for example 8.3.x to 8.3.36) rarely cause problems. Jumping from 7.x to 8.x may require code changes, so always test first.

Once patched, am I done?

New vulnerabilities will keep appearing, and PHP 8.2 support ends on 31 December 2026. Make sure someone is responsible for keeping PHP up to date.

How Digi Dinos can help

Digi Dinos is a software company with offices in Vietnam and Japan (Yokohama), with eight years of experience and more than 150 projects delivered. Our Japanese-speaking team takes care of old PHP systems: vulnerability fixes, upgrades and maintenance handovers.

Fast patching

Newly published PHP vulnerabilities (CVEs) handled quickly.

Full upgrades

PHP, Laravel, CakePHP or custom code, through to servers and operating systems.

No documentation needed

We read the code, rebuild the specifications and propose a complete plan.

Permanent warranty

For as long as your maintenance contract continues.

We handle legacy systems in other languages too.

PHP2shell and old PHP systems

Not sure whether your system is safe? Ask us

Tell us about your situation and we will work out the first steps together. We speak Japanese, English and Vietnamese.

See our takeover service Contact us

Sources

Information as of 28 October 2026.

PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now