You’ve probably never heard of PHP, but you use it every day. It runs behind a huge share of online shops, blogs, and login pages. This week, two serious flaws in it went public, and hackers moved fast.
What happened? The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP published them around 14:00 UTC on October 21, a day after details leaked ahead of a planned October 22 disclosure. Together they’re nicknamed “PHP2Shell.” They could let attackers run their own code on web servers without logging in. One security researcher said it’s one of the biggest vulns in years. PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge +2
The Bug: A Master Key Left Under the Doormat
- In short: Sites built on WordPress, Drupal, Magento, Joomla, Laravel and other PHP apps are exposed if they run a vulnerable PHP version. That could be the online shop where you saved your card, or your favorite blog. The flaws affect nearly every PHP version back to PHP 5.4. Worse, one bug can leak a server’s leftover memory, which can contain passwords, session tokens (the thing that keeps you logged in), API keys and other secrets from other visitors. Major security alert: PHP vulnerable to critical RCE, attacks ongoing - Patchstack +2
- Results: Emails from websites saying “we’ve detected unusual activity,” surprise password-reset requests, or being logged out of accounts randomly.
The Race: Hackers vs. Patchers
- The thing is, the fix exists, but it’s like a recall notice for cars. It only helps if owners actually take their car in.
- Cloudflare reported early attacks at 07:43 UTC on October 21, before the official fix even came out. watchTowr later said it was seeing active exploitation attempts of both flaws. The UK’s National Cyber Security Centre even urged organizations to consider taking offline any system that can’t be fixed right away. The slight good news: an attack needs specific knowledge of the target server and certain conditions, so mass exploitation is less likely than first expected. PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) +3
- What you must immediately do: Ask your hosting provider today whether they’ve updated PHP. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you’re on an old version like PHP 7, push for an upgrade. helpnetsecurity
Sources:
