PHP's fix for PHP2Shell is out. So are the first exploitation attempts.
By Lior AharonovFounder, 7IT Solutions ·
On 21 October 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution; SecurityWeek lists both at CVSS 9.2. Cloudflare, Patchstack, Hadrian and watchTowr reported exploitation attempts the same day, and watchTowr says none it saw has succeeded yet.
PHP sits under your shop, your CMS and the old admin panel you forgot about. The flaws reach PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, so every web-facing install is in the race right now.
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, rebuild your container images and restart every PHP worker. On PHP 8.1 or older, get a backport from your distribution or LTS vendor, or move to a supported release.
The warning gave you one day. The attackers used that day better.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.