MHOSTMHOST

Oct 21, 2026

PHP2Shell: Critical PHP Vulnerabilities — Update Now

On October 21, 2026, the PHP team released emergency security updates fixing two critical vulnerabilities in the PHP core — CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both are rated 9.2 out of 10 on the CVSS scale. If your VPS runs a PHP website, update it today.

Why it's dangerous

  • Remote code execution without authentication. A single request to your site is enough for an attacker to run their own code on the server. No login, password or admin access required.
  • Access to data on the server. Once they can run code, attackers can read database passwords, API keys and tokens from your site's configuration.
  • Any PHP website is affected. WordPress, Drupal, Joomla, custom projects and even a plain "Hello World" page. The attack fires before your site's own code even runs.
  • Any server setup. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all vulnerable.
  • The bug has been in PHP for years. It affects not only recent versions but very old ones too.
  • A working exploit already exists. Details leaked before the patch was released, and security researchers expect mass attacks in the coming days.

Fixed versions

The vulnerabilities are fixed in:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

Official announcement: php.net

What to do right now

1. Take a snapshot or backup of your VPS in the control panel so you can roll back quickly if anything goes wrong.

2. Check your current PHP version:

php -v

3. Update your packages.

On Ubuntu and Debian:

sudo apt update && sudo apt upgrade

On AlmaLinux, Rocky Linux and CentOS:

sudo dnf upgrade

4. Restart PHP.

If you use PHP-FPM:

sudo systemctl restart 'php*-fpm'

If PHP runs as an Apache module:

sudo systemctl restart apache2

5. Check the result. Run php -v again and compare the version with the list above.

Important: if PHP comes from the standard Ubuntu or Debian repositories, the version number may not match the list — distributions patch their packages without changing the main version number. In that case, make sure the security update for these CVEs is installed; it's listed in your distribution's security notices.

If you're on PHP 8.1 or older

PHP 8.1 and older no longer receive official updates from the PHP team. You have two options:

  • Move to a supported version — 8.3, 8.4 or 8.5. This is the safest choice.
  • Check for updates from your distribution. Some distributions and LTS vendors ship fixes for older branches. If there's no update, you need to upgrade.

Also note that PHP 8.2 reaches end of life on December 31, 2026, so it's worth planning a move off it too.

If you can't update right away

Put your site behind Cloudflare. Its WAF already includes rules against known variants of this attack, and they're available even on the free plan.

This is a stopgap, not a replacement for updating: new exploit variants may get past the filters. Update PHP as soon as you can.

Need help?

If something isn't working or you're not sure which PHP version your server runs, contact our support team — we'll help.

The MHost Team

← All news