On 21 October the PHP team shipped an emergency update. The reason is two vulnerabilities found in PHP itself (CVE-2026-109618 and CVE-2026-109619). Researchers named the attack that uses them PHP2Shell. The worst part: it needs no password and no admin login. One carefully crafted request is enough to run any code on the server.
It doesn't matter whether your site runs on WordPress, Laravel, Joomla, Magento or code written from scratch. The problem isn't in your site's code but in PHP itself, and it has been there since 2012, PHP 5.4. So sites that were built years ago and left alone because "it works, don't touch it" are at risk too.
Why you shouldn't wait
Cloudflare saw the first attacks about 6 hours before the patch came out. The technical details are now public, and automated scanners are already looking for servers that haven't been updated. On top of that, one of the bugs can leak data such as passwords and API keys from server memory.
It was taken seriously enough that several government websites in the Netherlands were temporarily switched off until the patch was out.
What to do
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On Ubuntu, Debian and RHEL a normal package update is enough. Then restart PHP-FPM or Apache.
- If your site is on shared hosting, ask your provider whether PHP has been updated. This can't be fixed from inside the site or with a plugin.
- If you're on PHP 8.1 or older, no official update is coming. There will hardly be a better reason to stop putting off the upgrade.
If you can't update right away, turning off session.upload_progress.enabled and blocking file-upload (multipart) requests at the web server lowers the risk. It isn't full protection, though. It only buys you time.
If the server was exposed before the patch, we also recommend checking for unknown PHP files created in the last few days and changing important passwords after the update.
Support from Coresoft
In critical security situations like this one, the Coresoft team quickly assesses the state of your servers and websites, applies the necessary updates without disrupting your business, and carries out follow-up checks. If you have questions about your server's security or need professional support, contact us.
