Critical PHP Security Vulnerabilities Disclosed: Update Your PHP Servers Immediately

Two critical vulnerabilities in PHP have triggered an urgent security advisory, with security experts warning organisations to update vulnerable servers as quickly as possible. Publicly disclosed on October 21, 2026, the flaws are collectively known as PHP2Shell and are tracked as CVE-2026-109618 and CVE-2026-109619.

The vulnerabilities could allow unauthenticated attackers to execute malicious code on affected servers, potentially exposing sensitive information, disrupting websites, and creating opportunities for further attacks. The National Security Agency (NSA) has urged organisations to prioritise security patches and identify systems running vulnerable PHP versions.

For businesses operating websites, e-commerce platforms, content management systems, and other PHP-powered applications, this is a security issue that requires immediate attention.

What Are the PHP2Shell Vulnerabilities?

PHP is a widely used server-side programming language that powers a substantial portion of the web, including platforms such as WordPress and Magento. Because PHP runs on web servers, weaknesses in the runtime can affect applications even when their own code has no known vulnerability.

The two PHP2Shell vulnerabilities involve unsafe memory handling when PHP encounters certain errors while processing HTTP requests.

CVE-2026-109618 involves memory corruption during out-of-memory handling. Under specific conditions, PHP may attempt to process internal data that was not properly initialised.

CVE-2026-109619 involves stale internal state that may persist after memory associated with a previous request has been released. A subsequent request can potentially interact with that invalid state.

These flaws may be exploited through specially crafted HTTP requests. Depending on the circumstances, successful exploitation could result in remote code execution, exposure of sensitive data, or service disruption.

Importantly, these are vulnerabilities in the PHP runtime itself. Updating a website theme, plugin, or application code alone does not resolve the underlying problem.

Which PHP Versions Are Affected?

Cloudflare reports that the vulnerabilities affect web servers running PHP 5.4 or later. The PHP security fixes released on October 21, 2026, cover the following maintained release branches.

Versions earlier than the corresponding patched release in each branch should be treated as vulnerable until the applicable vendor guidance confirms remediation. PHP 8.1 and older branches are end-of-life and do not receive regular upstream security updates.

Organisations using older versions should plan an upgrade to a supported PHP branch. Hosting providers and vendors that bundle PHP may also need to release their own updates.

Before upgrading, verify the official PHP advisory and your operating system or hosting provider's security notices to confirm the correct package for your environment.

Why Businesses Should Take These Vulnerabilities Seriously

A vulnerable PHP server can create risks beyond a temporary website outage.

Remote code execution

An attacker may be able to run unauthorised code on a vulnerable server. Depending on the server's permissions and configuration, this could lead to further compromise.

Sensitive data exposure

Successful exploitation could expose information accessible to the affected application or server, potentially including customer records, application data, or other sensitive information.

Website disruption

Attackers may be able to crash processes or interfere with application availability, affecting customers, employees, and business operations.

Further network compromise

If a compromised web server can access other systems, attackers may attempt to use it as a starting point for additional malicious activity.

The NSA has warned that PHP2Shell could enable attackers to take control of affected web servers without prior access or authentication. Organisations should therefore treat this as a high-priority infrastructure security issue.

Immediate Steps to Protect Your PHP Server

Organisations should take a structured approach to remediation rather than relying on a single security control.

1. Identify all PHP installations

Inventory web servers, application servers, containers, hosting accounts, and other services that use PHP. Prioritise internet-facing systems, especially those running older or unsupported versions.

Check the PHP version used by the web server itself, not only the version available in a command-line terminal. These can differ.

2. Apply the appropriate security update

Upgrade affected installations to the patched release for their supported branch, or install the corresponding security update provided by your operating system or hosting vendor.

Test the update in a suitable environment where practical, but do not let routine release procedures create unnecessary delays in addressing an actively exploitable critical vulnerability.

3. Keep web application firewall protection enabled

Cloudflare reports that it deployed PHP2Shell protections for customers using its web application firewall (WAF), including customers on its Free plan.

A WAF can help block malicious traffic and provide an additional layer of defence. However, it does not replace updating the vulnerable PHP runtime. Other WAF products may not provide equivalent protection, so verify your provider's specific guidance.

4. Increase logging and monitor suspicious activity

Review web server, PHP, firewall, and security monitoring logs for unusual requests, unexpected errors, repeated failures, or other suspicious activity.

Investigate potential indicators of compromise and preserve relevant logs. If exploitation is suspected, follow your incident response process and assess whether credentials, application secrets, or accessible data may have been exposed.

5. Isolate systems that cannot be patched

If an exposed system cannot be updated or adequately mitigated immediately, consider removing it from public access or taking it offline until it can be secured. This is particularly important for unsupported PHP installations.

The NSA specifically recommends considering offline isolation when an immediate update is not feasible.

6. Check third-party software and hosting providers

PHP may be embedded in commercial software, appliances, and managed hosting environments. Contact the relevant vendor or hosting provider to confirm whether a patch is available and whether the affected runtime has been updated.

Do not assume that a website is safe simply because its application code or plugins are up to date.

Is a WAF Enough to Prevent PHP2Shell Attacks?

No. A web application firewall is a valuable defensive layer, but it should not be considered a permanent fix for a vulnerability in the underlying runtime.

WAF rules can help identify and block malicious requests. However, protection depends on the provider, ruleset, configuration, and evolving attack techniques. A security update addresses the vulnerable PHP software itself.

The recommended approach is to patch PHP, retain appropriate WAF protections, monitor activity, and investigate any evidence of compromise.

Final Thoughts

The PHP2Shell vulnerabilities highlight why routine server maintenance and timely security updates are essential to website security. Even organisations with well-maintained applications may remain exposed if the PHP runtime beneath them is vulnerable.

Businesses should identify affected systems, apply the relevant security patches, review their monitoring and defensive controls, and upgrade unsupported PHP installations. Where immediate remediation is not possible, reducing public exposure is an important precaution.

Security teams should follow the official PHP security advisory, vendor guidance, and relevant national cybersecurity recommendations for the latest remediation instructions.

Official references

• Cloudflare: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
• NSA advisory: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/
• PHP security advisories: https://www.php.net/security/

How IPIX Technologies Can Help

Our team can help you identify vulnerable PHP versions, apply the necessary security updates, test your website after patching, and upgrade outdated applications to supported PHP versions. We also help businesses strengthen website security and reduce the risk of cyberattacks.

Need help securing your website or server? Contact IPIX Technologies to discuss your PHP security updates, website maintenance, and security requirements with our team.