The PHP developers have released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together known as ‘PHP2Shell’. They allow unauthenticated attackers to achieve remote code execution through web requests.
All PHP installations that handle web requests are vulnerable, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to the PHP development team, mod_php carries the greatest risk. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The potential impact is large. According to W3Techs, almost seventy percent of all websites run on PHP. VirusTotal says that four out of five PHP servers hide their PHP version. Several Dutch websites, including DigiD and the NCSC, were taken offline.
Dane Knecht, CTO of Cloudflare, said the company had observed the first attacks. The NCSC and CISA have not yet seen active exploitation. Two years ago, another PHP flaw (CVE-2024-4577) was widely abused a day after its patches appeared.
So patch immediately. CERT-EU advises taking systems that cannot be patched right away offline. The NCSC recommends assessing the risk for each internet-facing system that uses PHP. PHP 8.1 and older no longer receive updates, although minimal source backports exist.
Read php.net article for more information.
