What exactly happened with PHP in October 2026?

PHP's security team shipped an emergency release on 21 October 2026 fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on CVSS v4.0. Both can allow unauthenticated remote code execution under certain conditions. Details leaked a day ahead of the planned disclosure, which is why it's been widely covered under the press name "PHP2Shell."

Which PHP versions are affected?

PHP versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are affected. PHP 8.1 and earlier are past end of life for official PHP project support; the PHP security team published minimal source backports for 7.4, 8.0 and 8.1, but no official fix exists for anything older.

Does upgrading my framework (Laravel, WordPress, etc.) fix this?

No. This is a vulnerability in the PHP runtime itself, not in any specific framework or CMS. Updating Laravel, WordPress, or any other application layer does not patch PHP underneath it. You need to update the PHP version your server actually runs.

Is my site definitely vulnerable if I haven't updated?

Being on an affected PHP version means your server is exposed to this class of vulnerability, not that it has been compromised. Risk also depends on your exact server configuration; PHP's advisory notes that mod_php carries the highest risk, with PHP-FPM, php-cgi, FrankenPHP and LiteSpeed also affected.

Is this being actively exploited?

Reports differ. As of publication, the UK NCSC and NCSC-NL reported no confirmed widespread exploitation but noted public proof-of-concept code exists and expected attacks to increase. Other researchers have reported early exploitation attempts. Treat this as actively dangerous and prioritize updating regardless.

Can you just apply the PHP update for us?

Yes, that's exactly what our emergency patching service covers: reviewing your current PHP version and configuration, confirming backups and a rollback plan, applying the update, and testing your application before and after.

Will updating PHP break my application?

It can, particularly on older codebases with deprecated functions or outdated dependencies. That's why we test critical functionality before and after any update rather than just running an upgrade and hoping for the best.

What if I'm on a managed hosting provider?

Many managed hosts patch PHP centrally, but not all do so immediately, and some let you choose your own PHP version per site. We can help you confirm what your specific hosting setup actually runs and whether action is needed on your side.

Active Security Advisory

Critical PHP Security Vulnerabilities in October 2026? Get Expert Help

Critical PHP security vulnerabilities have been reported in October 2026. If your business runs Laravel, CodeIgniter, WordPress, or a custom PHP application, our team can help review your PHP environment, identify required updates, apply security patches, and test your application safely.

PHP, Laravel & CodeIgniter Expertise

Safe Updates with Backup & Testing

Support for Existing PHP Applications

Official advisories:PHP.net security release announcement CERT-EU Security Advisory 2026-018 UK NCSC: Critical security issue affecting PHP

The advisory, explained

What Happened, and What It Means for You

Published 2026-10-21 · Reviewed 2026-10-21 · CVE-2026-109618 and CVE-2026-109619, 9.2 (CVSS v4.0)

On 21 October 2026, the PHP project shipped an emergency security release fixing two critical vulnerabilities: CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (stale global state carried over between requests on the same worker). Both are rated 9.2 on CVSS v4.0. Details leaked publicly a day ahead of the planned disclosure, which is why the issue has been widely referred to in security press as "PHP2Shell."

Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are past official support; the PHP security team published minimal source backports for 7.4, 8.0 and 8.1 only.

What "remote code execution" means: under the right conditions, an attacker can get the server to run commands of their choosing, without needing a password or account on your site. That's the most severe class of web vulnerability there is.

Why every internet-facing PHP application should be reviewed: PHP's own advisory states that any installation serving web requests is potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk.

An updated framework does not mean PHP is patched: Laravel, WordPress, CodeIgniter and similar run on top of the PHP runtime. Updating the framework or CMS itself does nothing to the PHP version underneath it; the two have to be patched separately.

Why testing matters before you touch production: PHP version upgrades can break applications that rely on deprecated functions, outdated extensions, or old dependency versions. A rushed, untested update carries its own risk of an outage.

Free checker

Is Your PHP Version Updated? Check Now.

This check only compares the version number you enter against publicly known PHP security release information. We do not scan websites, probe servers, or attempt to detect your PHP version remotely, and a clean result does not mean your whole application is secure.

How we help

How We Help Protect Your PHP Applications

Emergency PHP Security Patching

Apply verified security updates to affected PHP environments with proper testing.

PHP Version Upgrade

Upgrade PHP installations and check application compatibility.

Laravel Security Updates

Review Laravel dependencies, PHP compatibility, and security updates.

CodeIgniter Security Updates

Review existing CodeIgniter applications, including legacy installations, and recommend safe upgrade options.

WordPress PHP Compatibility

Check PHP runtime compatibility with WordPress, themes, and plugins.

PHP Server Security Review

Review PHP configuration, hosting environment, patch status, and relevant server settings.

Process

Our Security Update Process

The initial assessment is free. Applying patches, upgrading PHP, and testing your application is scoped and quoted as paid implementation work once we understand your environment. We don't promise zero downtime or guaranteed security; we promise a careful, tested process.

Initial Assessment

Review the current environment and PHP version.

Risk Review

Identify relevant vulnerabilities and affected components.

Backup

Confirm backups and a rollback plan.

Security Update

Apply appropriate vendor-supported patches.

Testing

Check critical application functionality and integrations.

Deployment & Verification

Release safely and verify the final environment.

FAQ

PHP Security Vulnerability FAQ

Straight answers about the October 2026 advisory.

Direct contact

Need This Looked at Today?

Request a free assessment below, or reach us directly. A senior engineer typically responds within one business day; mark your request "Immediate" if it's urgent.

hello@digitalelitellp.com +91 91658 83017

Free PHP security assessment

Request Your Free PHP Security Assessment

Tell us about your application and we'll review your PHP environment and recommend next steps. No obligation.