Two critical PHP vulnerabilities could allow attackers to take control of vulnerable web servers without a password. Organizations that rely on PHP-based websites, portals or applications should take immediate steps to understand their exposure and confirm systems have been updated.
On October 21, emergency security updates were released for two critical vulnerabilities in PHP, commonly referred to as PHP2Shell. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 out of 10 for severity and can enable unauthenticated remote code execution on vulnerable systems.
Because PHP powers a significant share of websites and underpins widely used platforms including WordPress, Drupal, Joomla, and Laravel, the potential exposure is broad. Importantly, the vulnerabilities exist in PHP itself, not in an individual website, application, or plugin. That means even a well-maintained website could remain exposed if the underlying PHP installation has not been patched.
The most important action to take now
Organizations should ask whoever manages their websites, servers, and online applications to confirm in writing that affected PHP installations have been updated to one of the following fixed versions:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Or an appropriate patched package supplied by the organization's operating system, hosting or technology vendor
PHP 8.1 and earlier versions are no longer officially supported by the PHP project, making older environments an area of particular concern.
If the answer is "not yet," organizations need to ask when the update will be completed and what protections are in place until then.
Why PHP2Shell requires immediate attention
Unlike vulnerabilities that require an attacker to first obtain credentials or compromise a particular plugin, PHP2Shell can allow an unauthenticated attacker to execute code on an affected server. In certain configurations, an exploit can occur before the website's application code even runs.
There is also evidence of early attack activity. CyberScoop reported that Cloudflare had observed attacks emerging around the disclosure and deployed firewall protections while emphasizing that these measures are a temporary safeguard rather than a replacement for patching.
A compromised web server can create risks involving sensitive information, business disruption, and unauthorized access to other systems.
What organizations should do within the next 24–48 hours
Identify PHP exposure. Determine which public websites, customer and employee portals, e-commerce environments, and other internet-facing systems rely on PHP.
Verify patching. Obtain confirmation that systems are running one of the fixed PHP versions or an appropriate vendor-supplied security update.
Verify the updated version is running. Confirm the appropriate services have been restarted and the patched PHP version is active, not simply installed.
Address unsupported PHP installations. Systems running older PHP branches should be reviewed with the hosting, software or technology provider to determine the appropriate remediation.
Reduce exposure where immediate patching is not possible. Organizations should work with their IT and security teams on appropriate interim protections. Updating PHP remains the complete fix.
What organization should do this week
Review systems that were exposed before patching for signs of compromise.
Confirm website backups are current and appropriately protected.
Document when affected systems were identified, patched and validated.
Be alert for phishing messages or suspicious downloads claiming to provide an "urgent PHP update."
Don't assume your provider has handled it
Many organizations rely on hosting companies, web agencies, managed service providers or software vendors to maintain these systems, which can make PHP easy to overlook.
Organizations should ask providers directly:
Which of our websites, portals and systems run PHP, and which versions?
Have affected systems been updated to a fixed version?
When was the update completed, and was the updated version verified?
Is anything still running an unsupported version of PHP?
Have exposed systems been reviewed for signs of compromise?
For a vulnerability of this severity, "we patch regularly" is not enough. Organizations should seek specific confirmation.
How to Respond to PHP2Shell Vulnerabilities
The PHP2Shell vulnerabilities highlight the importance of maintaining current software, verifying security updates and understanding potential exposure across internet-facing systems. Organizations should confirm that affected PHP installations have been patched, review previously exposed systems for signs of compromise and work with their technology providers to address any remaining risks.
Share this article
Contact Our Technology, Risk & Compliance Professionals
Complete this form to discuss your PHP exposure and next steps.
By submitting this form, you agree to be contacted by UHY.
Author
TY COFFEE
Principal, UHY Inc.
Ty Coffee is a Principal in UHY's Technology, Risk, and Compliance Practice. Ty brings over 20 years of experience managing, performing, and delivering information technology security solutions that strengthen organizations. He specializes in technology risk management, IT audit, IT security assessments, internal auditing, attack‐and‐penetration testing services, and security analysis in domestic and global entities.