On October 21, 2026, patches were released for two critical security vulnerabilities—designated CVE-2026-109618 and CVE-2026-109619 and collectively referred to as "PHP2Shell." Both have been assigned a severity score of 9.2 out of 10 according to the CVSS standard.
These vulnerabilities could allow an attacker to execute arbitrary code remotely on a server, even without authentication. In a worst-case scenario, this could lead to the compromise of websites, the theft of sensitive data, or the use of the server to launch further attacks. The issue has also been highlighted by the National Cyber and Information Security Agency (NÚKIB) and the European security team CERT-EU, both of which strongly recommend the immediate installation of the security patches. Several key institutions—including the Office of the Government of the Czech Republic—have responded to the announcement and the potential risks by taking their websites offline.
The vulnerabilities reside within PHP itself, rather than in any specific content management system or web application. Consequently, they may affect any site built on PHP—such as those running WordPress, PrestaShop, or Drupal—as well as custom-developed applications. The vulnerabilities must be addressed at the server software level.
Patches have already been released. The corrected versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It is recommended that you update immediately. Unusual processes initiated by PHP services, for example, can be considered potential indicators of compromise, as they may suggest an attempt to exploit a vulnerability.
Saturday, October 24, 2026
