If your website runs on PHP, today is patch day, and the snooze button is not an option. The PHP project pushed out an emergency security release on October 21 to close two critical holes. Of everything on your to-do list, the PHP security patch is the one update you should not put off.
I’ll say it plainly: when a flaw gets a nickname like “PHP2Shell,” it is not a polite suggestion to update someday.
What the PHP security patch fixes
The two bugs are CVE-2026-109618 and CVE-2026-109619. Each one scores 9.2 on the CVSS v4.0 severity scale. Both can allow unauthenticated remote code execution, according to Help Net Security. In plain English, an attacker could run their own commands on your server without logging in (a burglar who doesn’t even need to jiggle the handle).
The fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some leaked social posts claimed a perfect 10.0 score. However, the official rating is 9.2, which is still about as bad as it gets.
Why the PHP emergency patch came early
This was not the original plan. The PHP team gave advance notice on October 20 of a release set for 10:00 AM ET on Wednesday. Even that was ahead of schedule. Security firm watchTowr said the details were originally due out Thursday at 11 am ET, as BleepingComputer reported.
Then the embargoed details leaked.
PHP had warned this could happen. The team said it reserved the right “to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” Both things appear to have happened.
Are attackers already using the vulnerability?
That depends on who you ask, so here is what is solid. Sansec reports that Cloudflare spotted early attacks at 07:43 UTC on October 21, hours before the patch landed. Cloudflare’s CTO, Dane Knecht, said the company was seeing early attacks. Meanwhile, watchTowr says it reproduced CVE-2026-109618, per Tenable.
Australia’s cyber agency took a more cautious line. It said it was “currently not aware of active exploitation related to these vulnerabilities.” Even so, Sansec expects mass exploitation now that patches and write-ups are public. Treat the threat as live, and apply the PHP update before attackers finish their own homework.
Here’s the thing: why this PHP vulnerability fix reaches your wallet
PHP powers a reported 69% of websites, according to Forbes. That is roughly seven out of every ten sites you might visit today. It covers content management systems, online stores and plenty of custom business tools. GoDaddy warned the flaws could mean stolen data, defaced sites or a full system takeover.
So who gets hurt? Anyone who runs a store, a blog, a booking page or a customer portal. If your site goes down or your customer data walks out the door, that is your problem, not PHP’s. Security shocks like this one ripple through the business world, much like the $6.3 billion Proofpoint-Varonis deal shows how much money now chases data protection.
The fallout is already visible. Dutch government platforms, including DigiD and MijnOverheid, had temporary outages as organizations pulled portals offline as a precaution. The EU’s CERT-EU told organizations to prepare for immediate patching. It said those unable to patch should consider taking affected sites offline.
What to do right now: apply the PHP security patch
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch.
- Ask your host. If a company runs PHP for you, confirm they have applied the patch.
- Check your version. Only PHP 8.2 through 8.5 get official fixes.
That last point is the ugly part. PHP 8.1, 8.0 and the 7.x line are end of life, so they get no patch from the PHP project.
Linux distributions and long-term support vendors reportedly received fixes in advance, so backports may be available. Check with yours, and treat any PHP2Shell patch from a vendor as urgent. If you run an older release, the standing advice from our look at why the polite alert gets shrugged off applies here too: the mild-sounding warning is the one people ignore.
What we still don’t know
Nobody has fully settled which older versions are affected. Some reports say PHP 5 through 8, based on leaked details. Sansec says 5.4 or later. Security firm watchTowr noted that the wider scope was not confirmed by a vendor advisory. PHP itself only issued fixes for 8.2 through 8.5.
The technical details are still being sorted, too. PHP says full code execution for CVE-2026-109618 was validated over the web against mod_php. The other setup, PHP-FPM, is considered susceptible, though no full exploit has been shown. NVD, the government’s vulnerability database, lists both records as received but has not yet scored them.
So the smart move is simple. Patch first, argue about version ranges later. Hackers are not waiting for the debate to end.
So, do you actually know which PHP version your site is running?
