PHP releases emergency patches for two critical PHP2Shell security flaws

PHP's security team warned administrators on October 20 to prepare for emergency updates addressing two critical vulnerabilities. Information about the flaws had reportedly leaked before their scheduled disclosure, according to BleepingComputer.

The bugs became known collectively as PHP2Shell. SecurityWeek identified them as CVE-2026-109618 and CVE-2026-109619 and reported that they could potentially allow unauthenticated remote code execution, meaning an attacker could run code without first logging in.

On October 21, attention shifted from preparing for disclosure to limiting exposure before the fixes arrived. The Defiant reported that patches were scheduled for 10 a.m. ET and that security advisories urged operators to restrict exposed services and prepare to patch immediately.

The same day, the EU's cybersecurity response team warned that organisations unable to patch quickly should consider taking their websites offline, according to The Next Web. That warning made temporary shutdowns a possible protective measure, rather than simply a consequence of an attack.

Temporary defences also came under scrutiny. The Hacker News reported that a configuration setting being circulated as a workaround was not sufficient on its own, according to the security firm that had suggested it.

PHP subsequently released the emergency patches on October 21, BleepingComputer reported. The released versions were 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as listed by Hacker News: Front Page Startups.

Also on October 21, The Cloudflare Blog announced protections against PHP2Shell. It said Calif.io, Wiz, OpenAI and Quarkslab had disclosed the two vulnerabilities, which it described as affecting all web servers running PHP 5.4 or later.

The emergency updates are now available. The story has moved beyond advance warnings about an imminent release: BleepingComputer confirms that PHP has shipped patches for both critical remote code execution flaws.

The available coverage does not establish how many websites have been compromised or taken offline. The EU advice reported by The Next Web concerns organisations that cannot patch quickly, not a confirmed widespread outage.

The immediate issue is how quickly operators can deploy the fixed PHP versions. For organisations that cannot update promptly, the EU response team's advice to consider taking sites offline remains the clearest contingency described in the coverage, according to The Next Web.

Temporary protections should not be confused with a complete fix. The Hacker News reported that the proposed configuration workaround was insufficient on its own, while The Cloudflare Blog announced separate protections. The coverage does not establish how broadly those protections have been adopted.