Two critical vulnerabilities in the PHP interpreter, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let unauthenticated attackers run code with the web server account’s privileges. Both are rated 9.2 under CVSS v4.0, according to Sophos.

The PHP Project released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. Apache mod_php setups face the greatest risk; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected.

CISA has confirmed the flaws are exploited in attacks. Amazon’s threat intelligence team says it saw an exploitation attempt on October 17, four days before public disclosure. A separate PHP flaw, CVE-2026-115560, has mitigation guidance but no patch yet.

Administrators should update to a fixed PHP build as soon as possible.

Sources

Image: Html php java source code (38891650224).jpg by Markus Spiske from Forchheim, Bavaria Upper Franconia, CC0, via Wikimedia Commons. Illustrative photo; it does not show the events described.