PHP Security Updates: Recent Vulnerabilities, Patched Versions & What They Mean for Your Business

The short version

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell (Help Net Security). Both carry a CVSS v4.0 score of 9.2 and allow an unauthenticated attacker to run code on your web server (CERT-EU).

This is not an application bug. It sits in the PHP interpreter itself, so every site on an unpatched version is exposed regardless of whether it runs Laravel, WordPress, Magento or custom code.

What to do today:

1. Find every server, container and cron box that runs PHP.
2. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — or your distribution's patched package.
3. Restart PHP-FPM, Apache or your container so the new binary is actually in use.
4. Check logs for suspicious requests from the days before you patched.
5. If a system cannot be patched today, take it off the public internet until it can be.

Every project Krispire Solutions maintains was audited and patched before this article went live. The section on our rollout explains how we did it, and what we would do in your position.

What was disclosed: PHP2Shell explained

Two separate memory-handling flaws in the PHP core interpreter let a single unauthenticated HTTP request reach code execution before any application code runs (Help Net Security).

Three details make this one worse than a routine PHP point release.

• The bugs are old. Wiz, which reported them, says every PHP version back to 5.4 is affected by at least one issue (Patchstack).
• Details leaked early. Technical information went public on 20 October, a day before patches shipped, and proof-of-concept code began circulating immediately (CERT-EU).
• Exploitation predates disclosure. Amazon's MadPot honeypot network recorded an exploitation attempt on 17 October, four days before public disclosure (Help Net Security).

Every PHP installation that serves web requests is in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php setups the most exposed. Wiz also demonstrated reading PHP worker memory — which can hold passwords, tokens and API keys — without executing code at all. Treat an unpatched server that faced the internet this week as potentially compromised, not merely at risk.

The patched PHP versions

Four releases carry the fix. Anything older than PHP 8.2 gets no official patch from the PHP project.

Support windows are from php.net; the patched version numbers are from the 21 October release and Laravel Forge's advisory.

If you are on PHP 8.1 or older, you have three options and only three. Check whether your Linux distribution or LTS vendor shipped a backported package, since vendors received the patches ahead of public release. Build from source using the minimal backports the PHP security team published for 7.4, 8.0 and 8.1. Or upgrade the application to a supported branch, which is the only option that stops this recurring every quarter.

PHP 8.2 users should note the date in that table. Security support ends on 31 December 2026, so a 8.2.35 patch today buys you roughly two months before the same conversation starts again.

How to check which PHP version you are running

The version your CLI reports is often not the version serving your website. Check both.

1# CLI version
2php -v
3
4# The version PHP-FPM actually serves
5php-fpm -v
6systemctl status php8.3-fpm
7
8# Every PHP binary installed on the box
9ls /usr/bin/php*
10
11# Inside a container
12docker exec <container> php -v
Copy

From the application side, a one-line script tells you what the web server uses: <?php echo PHP_VERSION; on a temporary page, deleted immediately afterwards. On shared hosting, cPanel, Plesk and CloudPanel each expose the active version in their PHP settings panel, usually per domain rather than per server.

The places teams forget to look are the ones that matter most:

• Staging and demo environments that share a network with production
• Docker images pinned to a tag like php:8.3-fpm that has not been rebuilt since the patch
• Cron and queue workers running a different PHP binary from the web server
• Legacy sites parked on an old subdomain that nobody has opened in a year
• CI runners, admin tools and internal dashboards

Patching the binary is only half the job. PHP-FPM and Apache keep the old code in memory until they restart, so a server can report a patched version while still serving the vulnerable one.

What this means for each stakeholder

A flaw in the interpreter spreads further than a flaw in one application. Roughly three-quarters of the web runs PHP somewhere, so the blast radius reaches people who have never written a line of it.

Two points deserve emphasis for non-technical stakeholders.

First, patching is cheap and a breach is not. The update itself is usually a package upgrade and a service restart, measured in minutes. Recovering from a web shell means forensics, rebuilt servers, rotated credentials, customer notification and, in regulated sectors, a disclosure timeline you do not control.

Second, "our site is small" is not a defence. These attacks are automated and indiscriminate — scanners sweep the whole internet for a vulnerable response, and a brochure site on a shared host is a foothold into everything else on that host.

What we did before publishing this

We patched first and wrote second. Every PHP workload Krispire Solutions builds or maintains for a client was inventoried, updated to a fixed release and restarted before this article went live.

The sequence we followed, and the one we would recommend to any team:

1. Inventory before touching anything. We listed every host, container and worker running PHP across client environments, including staging and internal tools, so nothing was patched by memory.
2. Patch the supported branches first. Servers on 8.2 through 8.5 moved to the fixed releases through distribution packages, which is faster and safer than building from source under time pressure.
3. Rebuild and redeploy containers. A pinned base image does not update itself. Images were rebuilt against patched bases and redeployed, not just restarted.
4. Restart and verify. PHP-FPM and web servers were restarted, then each environment was re-checked to confirm the running process served the patched version rather than the installed one.
5. Review logs for the exposure window. Access logs were checked for the period before patching, since exploitation attempts were recorded in the wild before public disclosure.
6. Rotate what could have leaked. Where a host was internet-facing and unpatched during the window, credentials were treated as suspect rather than assumed safe.
7. Confirm in writing. Each client was told which systems were affected, which version they now run, and when the change was applied.

None of this is heroic. It is ordinary patch management, done quickly because the inventory already existed. The teams that struggled this week were not the ones with weak engineers — they were the ones who did not know what they were running.

How to upgrade safely

A point release inside the same branch — 8.3.30 to 8.3.36, say — is low risk and should not wait for a change window. Moving between branches is a different job and needs testing.

On Debian or Ubuntu:

1sudo apt update
2sudo apt install --only-upgrade php8.3 php8.3-fpm php8.3-cli
3sudo systemctl restart php8.3-fpm
4php-fpm8.3 -v
Copy

On RHEL, Rocky or AlmaLinux:

1sudo dnf update php php-fpm php-cli
2sudo systemctl restart php-fpm
Copy

For Docker, rebuild rather than restart. Pull the patched base image, rebuild, redeploy, then confirm the running container reports the fixed version.

Framework-specific notes:

• Laravel — a same-branch patch needs no application change. Restart queue workers and Horizon as well as FPM, or they keep running the old binary. Run php artisan optimize:clear after the upgrade.
• WordPress and WooCommerce — the risk is in abandoned plugins and themes that break on a newer branch. Patch within your branch immediately; schedule the branch upgrade separately with a staging test.
• Legacy and custom PHP — if the app only runs on 7.4 or 8.0, isolate it now. Put it behind a WAF, restrict access by IP, or take it offline until it can be moved. Cloudflare has published rules covering the known exploit paths for these CVEs, available on all plans including free.

A WAF rule is a tourniquet, not a cure. It buys time to plan a migration; it does not make an end-of-life PHP version safe to run.

Frequently asked questions

What is PHP2Shell? PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Both allow unauthenticated remote code execution on web servers running PHP.

Which PHP version fixes CVE-2026-109618 and CVE-2026-109619? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026. PHP 8.1 and earlier receive no official fix from the PHP project.

Is my WordPress site affected? If it runs on an unpatched PHP version, yes. The flaw is in PHP itself, not in WordPress, so no plugin or theme update fixes it. Ask your host which PHP version your site uses.

I am on shared hosting. What can I do? Check the PHP version in your hosting panel and switch to a patched release if the option is there. If it is not, contact your host and ask when they patched. A host that cannot answer that question quickly is itself a risk.

Do I need to restart anything after updating? Yes. PHP-FPM, Apache or your container must restart before the patched code is actually used. Restart queue workers and cron-driven processes too.

How do I know if I was already attacked? Look for unfamiliar files in web-writable directories, unexpected outbound connections, new scheduled tasks, and requests in your access logs that produced errors or unusual response sizes before you patched. If anything looks wrong, treat it as an incident and bring in help.

Can I just wait for my next maintenance window? No. Exploit details were public before the patch, proof-of-concept code is circulating, and exploitation was recorded in the wild on 17 October, before disclosure.

Not sure what you are running?

If you cannot name the PHP version behind every site your business depends on, that is the finding — not the vulnerability. Krispire Solutions builds and maintains Laravel, Next.js and NestJS systems for clients across India and abroad, and patch management is part of how we run them.

We will audit your stack, tell you plainly what is exposed, and patch it. Get in touch and we will start with an inventory.

Sources

• Help Net Security — PHP2Shell: Critical PHP vulnerabilities patched, update now!
• CERT-EU Security Advisory 2026-018 — Critical Vulnerabilities in PHP
• Patchstack — Major security alert: PHP vulnerable to critical RCE
• Qualys — PHP announces critical security release for two vulnerabilities
• Laravel Forge — PHP security advisory (CVE-2026-109618, CVE-2026-109619)
• php.net — Supported Versions