PHP2Shell (CVE-2026-109618/109619): a 10-minute checklist for site owners

Yusuke Suda — Thu, 22 Oct 2026 07:30:11 +0000

On 21 October 2026 the PHP project shipped an emergency security release for two critical remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". A working exploit exists and, according to reports, a single unauthenticated request can trigger it before any application code runs. This is a plain checklist of what to do, collected from the public advisories listed at the end.

1. Know the fixed versions

Branch	Fixed in
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1 and older	no official release; source backports exist for 7.4, 8.0 and 8.1, otherwise ask your vendor or upgrade

Every PHP installation that serves web requests is in scope (PHP-FPM, Apache with mod_php, CGI, FrankenPHP, LiteSpeed). Setups using mod_php are described as the most exposed.

2. Find out what you are running

WordPress: Tools → Site Health → Info → Server.
Shell access: php -v (and check the version your web server actually uses, which can differ from the CLI).
Caveat: Linux distributions often backport fixes without changing the version number. An older-looking number is not proof you are unpatched; check your distribution's or host's security notice.

3. Act according to how you host

Managed WordPress hosting: look for your host's status page or e-mail confirming the patch. Usually nothing to do.
Shared hosting: ask your host directly whether the 21 October release is applied. If your PHP selector shows 8.1 or older, move to 8.2+.
VPS / self-managed: install your distribution's updated PHP packages now and restart PHP-FPM / the web server so every worker runs the fixed build. Remi repository users were advised that updates would not be available on release day.
Behind Cloudflare: Cloudflare deployed WAF rules for known vectors. Check they are set to block, not log. Treat this as a stop-gap, not a fix.
Stuck on 8.1 or older: take a full backup, test 8.2+ on a staging copy, then switch.

4. If you cannot patch today

Advisories mention disabling session.upload_progress.enabled as an interim measure against one vector of CVE-2026-109619, and the UK NCSC recommends taking systems offline if they cannot be fixed promptly. Only the update is a complete fix.

Sources

Help Net Security: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
Codeable (WordPress guidance): https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/
IPA (Japan) alert: https://www.ipa.go.jp/security/security-alert/2026/pre-alert20261021.html

Written by listingworks, a small data service in Yokohama. Facts as of 22 October 2026; check the advisories above for updates.

What nine job and property sites were advertising in mid-October 2026

Yusuke Suda — Wed, 21 Oct 2026 07:28:55 +0000

One-day snapshots from public list pages in the UK, Denmark, Croatia, Latvia, Pakistan, Luxembourg, Spain, India and Slovakia — counts and medians only, no personal data.

Official labour and housing statistics arrive weeks or months after the fact. The listing sites themselves update every hour. At listingworks I read the public list pages of job boards and property portals every day and turn them into small aggregate tables: how many postings or listings there are by region, and what pay or price they advertise. This is what nine of those sites showed on 15 October 2026 (all reads between 07:52 and 08:08 UTC).

Two cautions before the numbers. First, these are samples of the first N listings each search returned, not counts of the whole market; where the site publishes its own total I give it next to the sample. Second, pay and prices are advertised lower bounds, only from postings that state them, and medians are shown only where at least five values exist. Nothing here comes from a posting page, an employer name, or a contact.

Jobs: postings by region and advertised pay

Site (country)	Postings read	Site's own total	Largest regions in the sample	Median advertised pay (lower bound)
reed.co.uk (UK)	3,000 newest	99,651 live	South East 635 · London 564 · North West 358	London GBP 35,500/yr · South East GBP 35,000 · North West GBP 32,000 (2,163 of 3,000 state pay)
jobindex.dk (DK)	732	~19,000 live	Hovedstaden 246 · Syddanmark 130 · Midtjylland 129	not shown on list pages
cv.lv (LV)	2,173	2,174	Rīga 1,631 · Pierīga 192 · Zemgale 82	Rīga EUR 2,000/mo · Pierīga EUR 1,950 · Zemgale EUR 1,800 (2,139 state pay)
mojposao.hr (HR)	1,595	1,595	Grad Zagreb 902 · Zagrebačka 129 · Splitsko-dalmatinska 122	Grad Zagreb EUR 1,400 · Zagrebačka EUR 1,430 · Splitsko-dalmatinska EUR 1,592 (195 state pay; period not given)
posao.hr (HR)	2,000 (cap)	—	Grad Zagreb 376 · Istarska 174 · abroad 166	not shown on list pages
rozee.pk (PK)	3,000	10,169	Lahore 811 · Karachi 777 · Islamabad 433	Lahore PKR 62,500/mo · Islamabad PKR 50,000 · Karachi PKR 46,800 (168 state pay)

Three things stand out. Latvia is the only market in this set where almost every posting states pay (98%), because cv.lv requires it; the UK is next at 72% of the newest postings; Pakistan is at 6%. Denmark's jobindex.dk lists no pay at all on its search pages, which is why Danish pay statistics have to come from elsewhere. And in both Croatian boards Zagreb carries more than half of the volume on mojposao.hr (57%) but only 19% on posao.hr, which lists more seasonal coastal and foreign work — the two boards are not interchangeable.

Property: asking prices by city

Site (country)	Listings read	Scope	Median asking price (sale)	Median asking rent (month)
pisos.com (ES)	3,000 sale + 3,000 rent	10 provinces, 300 newest each	Madrid EUR 306,000 (EUR 3,547/m²) · Barcelona EUR 312,500 (EUR 3,295/m²) · Málaga EUR 465,000 (EUR 4,000/m²)	Madrid EUR 1,400 · Barcelona EUR 1,750 · Málaga EUR 1,800
athome.lu (LU)	1,588 sale + 540 rent	10 largest communes, 200 each	Luxembourg City EUR 762,167 (EUR 11,194/m²) · Esch-sur-Alzette EUR 495,000 (EUR 7,142/m²) · Differdange EUR 570,000 (EUR 6,951/m²)	Luxembourg City EUR 1,800 · Esch-sur-Alzette EUR 700
nobroker.in (IN, rent only)	2,471	~500 each in Bengaluru, Mumbai, Pune, Chennai, Hyderabad	—	Mumbai INR 42,000 (INR 781/m²) · Hyderabad INR 32,500 · Bengaluru INR 30,000

Málaga's newest listings ask more than Madrid's or Barcelona's, both in total and per square metre — the sample is the 300 newest per province, so this says something about what is coming onto the market now rather than about the stock. Luxembourg City asks 11,194 euros per square metre, three times Madrid. In India, Mumbai's rent per square metre is 2.4 times Bengaluru's even though the headline rents differ by only 40%: Mumbai flats in the sample are far smaller.

Used cars: one weekend on auto.bazos.sk (Slovakia)

5,717 car ads were listed or bumped on 14–15 October, at most 400 per make section (six sections hit the cap). By region: Nitriansky 950, Banskobystrický 772, Prešovský 719. Median asking price for the three largest makes: Škoda EUR 14,990, Volkswagen EUR 14,000, BMW EUR 11,700. Bazos list pages show no year or mileage, so those medians are empty.

How these tables are made

Sources: public list (search) pages only. Posting and ad pages are never opened.
Regions: the place as the site writes it, mapped with a small table per country (UK: 12 ITL1 regions; DK: 5 regioner; HR: 21 counties + abroad; LV: 6 regions, approximate; PK: 10 largest cities + other; SK: 8 kraje). A posting with several places counts under the first.
Job categories (in the per-category files): 13 groups by keywords in the title, first match wins. Approximate.
Pay and prices: lower bound of what the posting states; units and currencies are never mixed; price per m² = price / living area.
No personal data: employer and seller names are not in the tables at all. Where a scraper does return a company field, names that look like a person are blanked.

Get the data

The same tables, every day or every week, for one site or a bundle: listingworks.net (aggregate subscriptions from USD 99 a month; one-off extracts USD 49).
Run it yourself: the scrapers and the country statistics Actors behind these tables are on Apify Store at apify.com/listingworks (pay per result, about USD 1.50 per 1,000 rows; the statistics Actors return one row per region or category).
Free sample dataset (Poland, daily, CC BY 4.0): Kaggle and Hugging Face, user listingworks.

Next week's snapshot will add the same tables for Poland, Serbia and the Czech Republic, with week-on-week changes.

Yusuke Suda, listingworks (Yokohama). Figures read 15 October 2026. Corrections welcome by email.

DEV Community: Yusuke Suda