CWCS is monitoring a newly announced PHP security release relating to two critical remote code execution vulnerabilities, known as PHP2Shell – https://www.php2shell.com/. This article outlines what is currently known, the potential impact on affected servers, and the actions customers should take.
As further information becomes available, we will provide updates to help customers understand the situation and take the appropriate steps to protect their systems.
What has happened?
PHP has announced that it will be releasing a critical security update at 14:00 UTC (15:00 UK time) today, Wednesday 21 October.
You can read the official announcement here: PHP Security Release.
It is believed that this release will patch two remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have become known as PHP2Shell – https://www.php2shell.com/.
Is my server vulnerable?
If you run PHP version 5.4 or later on your server, then it is likely vulnerable to these issues.
Customers running PHP should review their current PHP version and be prepared to install the relevant security updates.
What is the impact?
Exploitation of these vulnerabilities allows attackers to remotely execute code on your server, with the privileges of the user running PHP.
This presents a significant security risk to affected systems, making it important to monitor developments and apply the appropriate security updates as soon as possible.
Is this vulnerability being actively exploited?
Cloudflare are apparently seeing early attacks emerging. There have also been suggestions that widespread attacks could begin shortly after the official release of information around how the exploit works.
Given these reports, customers should treat this issue seriously and take necessary steps to implement mitigation or deploy available patches.
Which PHP versions are these vulnerabilities fixed in?
We believe that the following upcoming PHP versions will contain fixes for these vulnerabilities:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Linux distributions and control panels, such as Plesk and cPanel, may backport patches for earlier PHP versions that they support, however, this isn’t guaranteed. As a result, the availability of fixes may vary depending on your operating system, control panel and PHP installation.
We will provide an update once fixed versions have been confirmed.
Is there a mitigation available?
Mitigation is limited, official details can be found here:
We strongly recommend installing PHP updates, rather than relying on these settings alone.
Cloudflare are deploying Web Application Firewall (WAF) rules for known exploit vectors. Cloudflare customers using their free or paid WAF are protected by default against php2shell – see https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
What actions are CWCS taking?
CWCS is carefully monitoring these vulnerabilities as more details emerge. We will take action as we deem appropriate to address the risks and protect affected systems.
Our planned actions include:
- Deploying mitigations on production systems, where appropriate.
- Prioritising updates to production and managed customer servers once patches become available.
We will continue to monitor developments and provide further information as confirmed details emerge.
What should I do?
If you have a server running PHP, you should install available PHP updates as soon as possible. If you are unable to install the updates, you may wish to consider the potential mitigations outlined above.
If you are running an end-of-life (EOL) version of PHP, we strongly recommend upgrading to PHP 8.2 or higher as soon as possible.
Keeping your PHP installation up to date is an important step in reducing exposure to security vulnerabilities. We recommend continuing to monitor official PHP announcements and applying the relevant updates promptly once they are confirmed.
For customers who have a management plan with us, CWCS will update and apply patches as and when released.
For unmanaged customers, you should install available PHP updates as soon as possible and confirm that you are running a patched version. If you would like CWCS to manage these functions for you in the future, get in touch with our team: https://www.cwcs.co.uk/contact
To read further on the PHP Security Vulnerability, we recommend only using trusted sources, such as providers like CWCS, and government resources. CWCS will provide a further update once the fixed PHP versions have been confirmed. In the meantime, find more information here on the UK Government page: Critical security issue affecting PHP
Resources:
- Official Research – https://www.php2shell.com/
- PHP Official News Page – https://www.php.net/archive/2026.php
- PHP Official Github Repository – RCE via OOM corruption
- PHP Official Github Repository – RCE via stale global state
- Cloudflare Official Response – https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
