If you run anything on PHP, stop what you are doing and check your version.
What happened?
PHP just fixed two serious security bugs: CVE-2026-109618 and CVE-2026-109619. The community nickname is "PHP2Shell".
Both are rated critical (9.2 out of 10) and can allow an attacker to run their own code on your server, without logging in.
Why is this a big deal?
The bugs are in PHP itself, not in your code. Any site on a vulnerable PHP version is exposed, whatever it is built with: WordPress, Drupal, Magento, Joomla, Laravel...
Researchers at Wiz, who found the bugs, say even a simple "Hello World" app can be vulnerable. They also showed that an attacker could read a PHP worker's memory, which can contain passwords, tokens and API keys.
In plain words: if PHP runs your website, a stranger might be able to take control of it.
How does it work? (the short version)
Without the details: the bugs happen when PHP runs out of memory while handling a request. This can corrupt its internal data, and under certain conditions, an attacker can turn that into code execution.
Am I affected?
Almost certainly, if you did not update this week.
All PHP versions from 5.4 up to 8.5.11 are vulnerable.
How do I fix it?
Upgrade to a patched version:
| Your branch | Safe version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older are end of life and will not get a fix. If you are still on one of them, plan your upgrade now. You are on your own until then.
Quick checklist:
- Run
php -von every server you manage. - Update PHP (package manager, Docker image, or your hosting panel).
- Rebuild and redeploy your containers, since old images keep the old PHP.
- Restart PHP-FPM / Apache so the new version is actually running.
- Using shared hosting or a panel like Plesk? Check that your provider has updated.
Is it being exploited?
At the time of writing, there were no confirmed zero-day attacks, but exploit attempts have started to appear. Details are public now, so do not wait.
Takeaway
Patch first, read the blog posts later. It takes a few minutes and could save you a very bad week.
Sources: PHP security advisory, Wiz Research, NCSC, Patchstack
Top comments (0)