Critical PHP fix released · 21 October 2026 · update now

PHP2Shell: PHP security update, October 2026. Is your website affected?

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws (CVSS 9.2) that let attackers run code on web servers without logging in. PHP 8.1 and older got no official release. Enter your domain and we tell you, in plain words, what the PHP version your site discloses means for you.

Loading the check …

Free · Nothing to install · One normal page request, no attack traffic. Last updated

What happened

Two critical flaws in PHP itself.

PHP runs most of the web, including WordPress, WooCommerce, Shopware, Magento and many agency sites. On 21 October 2026 the PHP project released fixes for two critical vulnerabilities. Both allow unauthenticated remote code execution: an attacker can run their own code on the server with a web request, and for Apache with mod_php a demonstrated exploit works before any application code runs.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Details leaked a day early, and security firms expect attackers to scan for unpatched sites right away. Updating WordPress or plugins does not help: the fix is a PHP update on your server.

Fix released
21 October 2026
Fixed versions
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Severity
Two critical flaws, CVSS v4.0 9.2 each
Impact
Unauthenticated remote code execution
CVE IDs
CVE-2026-109618, CVE-2026-109619
At risk
Any PHP serving web requests: PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP, LiteSpeed
No official release
PHP 8.1 and older (source patches only for 7.4, 8.0, 8.1)
Exploitation
Disputed (23 October 2026): first attempts observed 17 October 2026 (AWS MadPot), a Cloudflare wave at 07:43 UTC on 21 October, still before the fix (via Sansec), exploitation in the wild (watchTowr); Sansec and Germany's BSI see no successful exploitation at scale. No compromised site publicly confirmed

Source: the PHP project's security advisory of 21 October 2026. Linux distributions and LTS vendors received the patches in advance, so their packages may carry the fix under a different version number.

What to do now

Three steps for site owners.

01

Find out your PHP version

Enter your domain above. If the check can't see the version, we'll find it out for you.

02

Update now

You need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. On a supported branch this is a normal PHP update. We apply it for you, with a backup and a test, within 24 hours of your approval.

03

On PHP 7, 8.0 or 8.1? Upgrade

The PHP project released no update for these versions, only source patches for people who build PHP themselves. The real solution is moving to a supported version, and we do that for you, including a backup and a plugin check.

Not sure where to start? How to check and update your PHP version in cPanel, Plesk or WordPress
Auf Deutsch: PHP-Sicherheitslücke prüfen und beheben

After the update

PHP is one door. What else is open?

A critical PHP flaw is the kind of risk that sits under a site for months unnoticed. The Zybee Exposure Report checks what your website shows the internet from the outside: outdated software, exposed keys and files, forgotten admin pages and missing protections. Every finding is reviewed by a person, with a clear order of what to fix first.

  • Outdated components like this PHP release, with the evidence
  • Exposed credentials, backups and configuration files
  • Fix instructions for your developer, host or AI coding tool
$249One-time. Delivered in 12–48 hours. Pay after delivery.
Request your Exposure ReportHelp with the PHP update

Questions

The PHP update, answered.

Something else on your mind?

Ask us
What are CVE-2026-109618 and CVE-2026-109619?

Two critical flaws in PHP itself, the language behind most websites, including WordPress and most online shops. Both allow unauthenticated remote code execution: an attacker can run their own code on the server with a web request. CVE-2026-109618 abuses out-of-memory handling, CVE-2026-109619 stale state between requests. The PHP project rates each 9.2 on the CVSS v4.0 scale. Security researchers call them "PHP2Shell".

When was the PHP security update released?

On Wednesday, 21 October 2026. Details had leaked the day before, and security firms expect attackers to scan for unpatched sites right away, so update today.

Which PHP versions fix the flaws?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any older release on those branches needs the update. PHP 8.1, 8.0, 7.x and 5.x got no official release; the PHP project published source patches for 7.4, 8.0 and 8.1, and some Linux distributions and LTS vendors backport the fix. Note that PHP 8.2 reaches end of life on 31 December 2026.

Is PHP2Shell already being exploited?

It is disputed, as of 23 October 2026. watchTowr and Amazon report attacks; Amazon saw the first attempt on 17 October, four days before the fix. Sansec says the public exploits do not work against a default PHP installation, and Germany's BSI knows of no successful exploitation at scale. VulnCheck says it has a working exploit, for its customers only. No compromised site has been publicly confirmed. Update anyway: a working exploit exists and could become public at any time.

Which servers are at risk?

According to the PHP project, all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where a demonstrated exploit works before any application code runs.

My site runs on WordPress. Does updating WordPress help?

No. The flaws are in PHP itself, the language WordPress runs on, not in WordPress. What counts is the PHP version on your server, and your hosting provider controls that.

I'm on shared hosting. What can I do?

Shared hosting is fine: we work with your existing hosting account and move your site to the newest supported PHP version it runs on, with a backup and a plugin check. You don't need to change hosts. The first assessment is free.

The check says it can't tell. Am I safe?

Not necessarily. It means your server hides its PHP version or reports a distribution package, so we can't judge from outside. We'll find out for you and apply the update if it is missing. The first assessment is free.

Is there a way to protect myself until I can update?

Only partly. The PHP project lists settings that block specific attack paths, such as disabling session.upload_progress.enabled and lowering post_max_size, but says plainly that they do not make an installation safe. Updating is the only complete fix.

Is this check safe for my site?

Yes. We request your start page once, exactly like a visitor's browser, and read the server headers and the WordPress version the page names. We send nothing that tests the flaw. Repeat checks within ten minutes reuse the first result, so they don't hit your site again. We keep the domain, the result and a pseudonymised form of your IP address for 90 days to prevent abuse, then delete them automatically.

Sources