Check for PHP2Shell flaws: Users face risks from emergency web updates
Two severe PHP vulnerabilities force sites offline for patching, exposing visitors to potential data theft and compromised trusted channels during maintenance.
Key points
- Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution without authentication.
- The PHP project released emergency updates for versions 8.2 through 8.5 on October 21 to address the high-severity issues.
- Users should expect temporary website downtime as administrators apply fixes and check for signs of compromise on familiar sites.
The PHP2Shell vulnerabilities affect the PHP programming language, which powers a significant portion of the web, including platforms like WordPress, Drupal, and Magento. According to Malwarebytes Labs, these two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, have prompted widespread emergency maintenance. Websites are going offline temporarily as administrators rush to install security updates and patch their servers against active exploitation attempts.
Root cause
The vulnerabilities carry a severity rating of 9.2 out of 10, indicating a critical risk level. The PHP team states that all installations serving web requests are at risk. In certain configurations, an attacker can trigger the exploit before the website’s own application code even runs. This allows malicious code to execute on the server with the permissions available to the PHP process, potentially bypassing standard application-level security controls.
Attack path
Successful exploitation lets attackers run malicious code on affected servers without needing to log in first. Cloudflare’s chief technology officer, Dane Knecht, reported early attacks emerging and warned that firewall mitigations are only a stopgap. Attackers could use this access to steal application data, alter website content, or establish a backdoor for persistent access. The code runs with the privileges of the PHP process, granting significant control over the server environment.
Affected versions
The PHP project released fixes in specific recent versions on October 21 at 10:00 am ET. The patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users running these versions should update immediately. PHP 8.1 and older versions no longer receive routine security updates from the PHP project. Administrators using those legacy versions must check if their vendor supplies a fix or arrange an upgrade to a supported version to remain secure.
Mitigation
- Install the emergency security updates for PHP 8.2, 8.3, 8.4, or 8.5 immediately.
- Check with your hosting provider or operating system vendor for the appropriate updated packages.
- Isolate internet-facing applications from public networks if an immediate fix is not feasible.
- Identify all PHP-based applications and patch them as soon as possible, per CERT-EU recommendations.
For customers and users
When you see a site in maintenance mode, it may be a protective measure rather than a breach. However, assume the site’s reputation is compromised until confirmed otherwise. Check for unexpected content changes, sudden downloads, or repeated login prompts on familiar sites. These signs often indicate hijacking. If a site behaves strangely, leave the page immediately. Contact the organization through a separate, trusted channel to verify the status. Do not enter credentials or download files from a site showing irregular behavior during this period.
What to do and how to stay safe: PHP
- Verify that your own organization’s web servers are running a supported PHP version and have received the latest patches.
- Monitor trusted websites for unexpected redirects, altered content, or repeated authentication requests that may signal compromise.
- Contact service providers directly through known phone numbers or official support channels if a site appears offline or behaves unusually.
- Ensure your browser and security software are updated to block known malicious redirects and phishing pages associated with these exploits.
Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are so many websites offline right now?
Administrators are taking sites offline to install emergency updates for the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Does updating WordPress fix this PHP vulnerability?
No, updating WordPress or its plugins is not the same as updating the underlying PHP installation; the hosting provider or server admin must apply the PHP fix.
Are older PHP versions protected by these updates?
No, PHP 8.1 and older no longer receive routine security updates from the PHP project; users must check with their vendor for fixes or upgrade.
