PHP2Shell: a critical flaw in PHP itself (CVE-2026-109618, CVE-2026-109619)
On October 21 the PHP project shipped an out-of-band update: two bugs in the interpreter itself can, in some setups, let an attacker run code on the server without logging in. Rated 9.2 out of 10, and public exploits already exist.
Who is affected
Any site running PHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12: WordPress, Joomla, Drupal, Laravel and custom code alike. Branches 8.1 and older get no official fix. WordPress itself needs no update, the fix is in PHP. The risk is highest on Apache with mod_php and lower on PHP-FPM.
How to check
Your PHP version is in the hosting panel or from php -v. From the outside it is visible only if the site itself exposes it in the X-Powered-By or Server headers.
How to fix
Update PHP to the fixed release of your branch and restart PHP-FPM or Apache. If you cannot do it right away, turn off session.upload_progress.enabled: it closes one attack path, not all of them.
What Shield checks free
If the PHP version is visible in headers and older than the fixed one, Shield reports a critical finding with CVE links. If the version is hidden (which is good practice) it cannot be checked from outside: Shield will tell you to look it up at your host.
Good to know
Amazon and watchTowr report exploitation attempts before the patch was public. We updated our own servers on October 22.
