Critical Security Alert: PHP2Shell Vulnerabilities CVE-2026-109618 & CVE-2026-109619

We believe that technology can improve the way a business operates

Critical Security Alert: PHP2Shell Vulnerabilities
CVE-2026-109618 & CVE-2026-109619

NEWS | 23 Oct 2026

Two critical zero-day vulnerabilities, known as PHP2Shell, have been discovered in the PHP core engine. These vulnerabilities could allow an unauthenticated attacker to remotely execute malicious code on vulnerable web servers.

Who is affected?

The vulnerabilities affect web server environments running PHP 5.4 through PHP 8.5, including common configurations such as:

Apache with mod_php
PHP-FPM
Nginx
WordPress
Drupal
Joomla
Other applications running PHP

Why is this critical?

The vulnerabilities are already being actively exploited. Cloudflare reported millions of exploitation attempts following the public disclosure, highlighting the urgency for organisations running PHP–based web applications to take action.

For more information:

Recommended Actions

1. Patch immediately

Upgrade affected PHP installations to the appropriate security–fixed versions as soon as possible.

2. Apply temporary mitigation

If immediate patching is not possible, apply the recommended configuration changes and other mitigations to reduce exposure while the patching process is completed.

3. Consider virtual patching

Organisations that cannot patch immediately can consider third–party virtual patching solutions, such as Vicarius, to provide an additional layer of protection while permanent remediation is being carried out.

Need Help?

If you are unsure whether your environment is affected, need assistance identifying vulnerable PHP servers, or require virtual patching as a temporary mitigation, contact us. Our team can help assess your environment and recommend the appropriate remediation approach.

Do not wait for an incident. If you are running PHP, check your environment and patch now.