PHP2Shell: Two Critical PHP Flaws Prompt Patch-or-Pull-Offline Warnings

PHP runs a very large share of the web, and on 21 October 2026 its maintainers released emergency fixes for two critical flaws that can let an attacker run code on a server without logging in. The US National Security Agency told organizations that use PHP to update immediately or, if they cannot, take the systems offline until they can. The flaws have been nicknamed PHP2Shell.

A note on method: technical facts come from PHP’s own announcements and advisory. Statements by agencies and researchers come from the reports of ExecutiveGov, The Register and TechCrunch. The NSA’s own page returned an error when we tried to open it, so we cite it only as reported. We are not publishing exploit details. Analysis is labelled as ours.

What happened

According to php.net, the PHP security team announced on 20 October that a critical security release would follow at 14:00 UTC on 21 October. It released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on that day. Each announcement says the releases fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution, and that updating is the only safe choice. PHP rated both at 9.2 on the CVSS v4.0 severity scale.

PHP’s advisory describes the two bugs in general terms:

• CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partly set up, and cleanup may then treat the invalid data as valid.
• CVE-2026-109619: state belonging to one request can survive after its memory is freed, and a later request handled by the same worker may use that stale state.

The advisory rates the risk highest for mod_php, the Apache module, where it says an unauthenticated request can trigger a demonstrated exploit before any application code runs. Other affected setups named in the reporting include PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

What agencies and researchers said

ExecutiveGov reports that the NSA and the US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching. The NSA warned that successful attacks could lead to data theft, service disruption or movement deeper into networks, and said cyber actors are likely to weaponize the flaws. CISA said it had not observed exploitation, and recommended prioritizing internet-facing systems and taking inventory of PHP use, since PHP is often embedded in other software.

The Register reports that the EU’s computer emergency response team, CERT-EU, advised organizations that cannot patch immediately to isolate internet-facing applications, and that some European government sites, including Finnish and Dutch services, were taken offline as a precaution. It also quotes a researcher at the security firm watchTowr, who said the team was seeing exploitation attempts using the “php2shell” name in the user-agent field, and that nobody had succeeded so far, though he did not expect that to last. That is one vendor’s observation and may be out of date.

TechCrunch’s wider report on the same day described an unusually busy day for security teams, with separate problems in Node.js, the LiteLLM software package and a certificate authority. It says the PHP flaws were discovered with the help of AI, though it does not say by whom, and it notes that the incidents were unrelated.

What PHP recommends

PHP’s advisory lists partial workarounds, but is clear that they are not complete. Updating is the full fix. For versions that no longer receive support, PHP says 8.1 and older no longer get official updates and that it has issued limited emergency backports for 7.4 through 8.1. On 23 October PHP published a follow-up informational advisory about a narrower, separate issue (CVE-2026-115560) involving session upload progress and recommended a setting to disable it.

The Dutch National Cyber Security Centre (NCSC-NL) maintains a public list of affected products on GitHub, which we took to be its official page. When we checked on 29 October (this post was updated that day) it showed 925 tracked products, of which 223 were vulnerable, 153 fixed, 348 under investigation and 200 not affected.

Why it matters

PHP is widely embedded (our analysis). PHP powers many well-known content management systems and web applications. The Register quotes Huntress’s John Hammond as saying the number of places to check for vulnerable PHP versions is “very big, very fast.” Even if you do not write PHP, products and appliances you run may contain it.

Patching is only part of the work (our analysis). The first problem teams face is knowing where PHP runs. CISA’s advice to inventory PHP use, and NCSC-NL’s list of vendor products still under investigation, both point to this.

A short checklist (our analysis, based on the advisories)

• Find every PHP deployment, including software that does not advertise that it uses PHP.
• Update to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or install your vendor’s backport.
• Treat end-of-life PHP as urgent. Versions that no longer get official updates should be replaced, or isolated if they cannot be.
• If you cannot patch yet, follow the agencies’ advice to isolate or take systems offline, and use PHP’s interim settings only as a stopgap.
• Watch for signs of attack, such as web worker processes starting shells or downloading tools, as ExecutiveGov’s summary of the agencies’ guidance suggests.
• Check vendor advisories for embedded products, and keep an eye on NCSC-NL’s list.

Caveats

• Exploitation status is mixed. CISA said it had seen none, the NSA expected weaponization, and watchTowr reported attempts. NCSC-NL’s page does not itself confirm active exploitation.
• We could not open the NSA’s own statement, so its wording reaches us through ExecutiveGov, The Register and TechCrunch.
• Early write-ups from outside PHP disagree on details, so use php.net and your vendor for version numbers and mitigation steps.

The bottom line

Two critical bugs in one of the web’s most widely used languages produced a rare instruction from a national security agency: patch now, or take the system offline. The fixes exist. For most teams the harder task is finding every place PHP is running before someone else does.

Sources

• php.net: security announcements and advisory for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP project, 20 to 23 October 2026; primary source)
• NCSC-NL: php2shell operational information (Dutch National Cyber Security Centre, as published on GitHub)
• ExecutiveGov: NSA, CISA Urge Immediate Patching of Critical ‘PHP2Shell’ Vulnerabilities
• The Register: PHP devs publish critical bug fix as site owners warned: Pull ’em offline if you’re unpatched
• TechCrunch: The internet is having a very bad cybersecurity day