PHP2Shell, What Was That About?

Recently, about two weeks ago on 21 October 2026, there were two vulnerabilities announcement which shook most of the internet, caused permanent EoS (End of Services) at web based games like World Quest and Emergency Maintenance at some other like Umamusume: Pretty Derby, Grandblue Fantasy, and Path of Titans. The vulnerabilities affecting PHP based server, named CVE-2026-109618 and CVE-2026-109619. All the affected PHP servers deployed emergency downtime and patches. Is it that serious?

PHP2Shell

It is not a named library. It is a term. The term refer to the two vulnerabilities because it can directly access the web shell from PHP. It is not your common SQL Injection or link based vulnerabilities. It is a remote code execution vulnerabilities which access through PHP runtime. If your PHP version is not included with the patched version from the PHP officials, then your server is vulnerable.

You need to upgrade your PHP versions, remake all the deployed containers, and restart all the web servers to make sure that the PHP installation is safe from the vulnerabilities. As we spoke, some bot anywhere might perform the said attack and access the PHP runtime and execute malicious code. Even if your code is only this:

<?php

echo "Hello World!";

If your php version is not updated, it is vulnerable.

What PHP Version Should I Upgrade To?

To be safe, it is better to upgrade to latest PHP 8.5. But if for some reason your server is not compatible to install latest PHP, there are some other options:

Active Branch	Minimum Safe Patch Version	Support Status Notes
PHP 8.5	8.5.12	Recommended (Current latest stable branch)
PHP 8.4	8.4.27	Recommended (Fully supported until end of 2028)
PHP 8.3	8.3.36	Security-only support phase
PHP 8.2	8.2.35	Reaches End-of-Life on Dec 31, 2026. No further patches after this.

Then what you need to do is restart the web server and do clean build for your container. Make sure that your PHP installation follows the latest version.