Back
PHP2Shell: Two Critical PHP Vulnerabilities and What You Need to Know Right Now

PHP2Shell: Two Critical PHP Vulnerabilities and What You Need to Know Right Now

WARNING Publication date: 2026-10-21

Two critical vulnerabilities in PHP, potentially allowing remote code execution, have prompted urgent security warnings. With an emergency security release expected today, October 21, administrators are being urged to prepare their systems for immediate updates.

Update - NVD has finally published it's CVE Reports

As such you can consult our Q & A and AI assistant for more details on remedial action.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been dubbed PHP2Shell. Both reportedly allow attackers to execute unauthorized code on affected servers, potentially compromising websites and applications. Given PHP's widespread use in platforms such as WordPress, Joomla and Drupal, the potential impact is significant.

What Do We Know So Far?

Security researchers at watchTowr have published a detailed analysis of the emerging situation. According to their findings, both vulnerabilities reportedly enable remote code execution (RCE), and PHP versions dating back to PHP 5 may be affected. However, the affected version range has not yet been officially confirmed.

The PHP Security Team has announced that both vulnerabilities carry a CVSS v4.0 severity score of 9.2, indicating critical severity. watchTowr reports that, as of October 21, there is no confirmed exploitation in the wild, and no official workaround or patched version has yet been released.

PHP2Shell could potentially affect PHP installations dating back to PHP 5, making rapid identification of affected systems a priority for administrators worldwide.

The situation has already prompted precautionary action. Dutch cybersecurity news website Security.NL has temporarily entered maintenance mode, explicitly citing PHP2Shell. Meanwhile, SURFconext and the Dutch Informatiebeveiligingsdienst (IBD) have issued warnings and urged organizations to prepare for emergency patching.

When Will Patches Be Available?

The PHP Security Team has scheduled an emergency security release for Wednesday, October 21, 2026, at 16:00 CEST (14:00 UTC). The release is expected to clarify which PHP versions are affected, provide technical details and introduce the necessary security fixes.

The publication may be brought forward, so administrators should monitor the official PHP announcement closely.

What Should Administrators Do Right Now?

Although the precise scope of the vulnerabilities remains unconfirmed, administrators can already take several practical steps to prepare their environments.

  1. Identify PHP installations. Check servers, websites, Docker containers and hosted applications. On Linux, run the following command to identify the installed PHP version:
php -v

Remember that web servers may use a different PHP runtime than the command-line interpreter.

  1. Assess potential exposure. Prioritize internet-facing applications, including WordPress, Joomla, Drupal and custom PHP applications. According to watchTowr, versions dating back to PHP 5 may be affected, although this remains unconfirmed.
  2. Prepare for immediate patching. Identify your update mechanisms, contact hosting providers where necessary and ensure backups are available.
  3. Monitor the official announcement. The PHP Security Team will publish the confirmed affected versions, technical details and available security fixes.
  4. Apply and verify updates. Install the corrected PHP releases promptly, restart affected services and confirm that applications are running the patched versions.

Until the official advisory is published, administrators cannot definitively establish which installations are vulnerable. Preparation and rapid patching remain the most effective response.

Monitor PHP Vulnerabilities With BaseFortify

Critical vulnerabilities such as PHP2Shell demonstrate the importance of maintaining an accurate inventory of the software your organization depends on. Knowing which technologies are in use makes it easier to identify potential exposure and respond quickly to newly disclosed threats.

With BaseFortify, organizations can add PHP as a monitored software component and track newly disclosed vulnerabilities affecting their environment, alongside other software and technologies.

For example, PHP 8.3.0 can be identified using the following Common Platform Enumeration (CPE):

cpe:2.3:a:php:php:8.3.0:*:*:*:*:*:*:*

By adding the corresponding PHP component to your BaseFortify inventory, you can monitor vulnerabilities associated with that software. Be sure to select the version actually deployed in your environment.

Registration is currently free. Visit https://basefortify.eu/register to create your account and start monitoring PHP and other components.

Sources and Further Reading

This article reflects information available on the morning of October 21, 2026, before the scheduled PHP security release. Technical details and affected versions may change following the official disclosure.