PHP Patches Two Flaws That Let Attackers Run Code Without Logging In
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21, 2026, fixing two flaws that it says can let an attacker run code on a web server without logging in first. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.K. National Cyber Security Centre (NCSC) each published an alert the same day telling organizations to update immediately.
Anyone serving a website with PHP is in scope. The project's security advisory says the two flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It puts the risk highest for mod_php, where it says an unauthenticated request can trigger the attack before any of a site's own code runs. CISA says the two flaws, CVE-2026-109618 and CVE-2026-109619, are known as php2shell.
CISA told organizations to inventory every system running any version of PHP, warning that PHP is often a component of other software and may not be directly observable, and to patch internet-facing systems first. CISA also said organizations that cannot update at once, or that are still running PHP 8.1 or an earlier unsupported version, should take PHP-based systems offline until they can be patched. The agency said a web application firewall may provide some protection, and that it had not observed exploitation as of the time it published.
The NCSC said U.K. organizations that cannot update or apply the project's temporary measures quickly should consider taking the system offline, and that anyone who has to wait should look for evidence of compromise, including attacker-installed backdoors, before upgrading.
The project said Linux distributions and long-term support vendors received the patches in advance, so operators should check their vendor for updated packages. PHP 8.1 and older no longer receive updates from the project, which said it provided minimal source backports for PHP 7.4, 8.0 and 8.1 to those building from source or without an LTS vendor. The project said those measures reduce exposure to specific attack paths but do not make an installation safe, and that updating is the only complete fix.
