PHP releases fixes for critical PHP2Shell flaws after details leak online

PHP released security fixes for two critical vulnerabilities at around 10 a.m. ET on Oct. 21, after details of the bugs leaked online the previous day and the release was brought forward. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, available from php.net. InvestmentNews first reported the alert and its reach into advisory firm websites and client portals.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell". Both are rated 9.2 out of 10 for severity, and they can let an attacker take control of a web server without logging in.

Advisory practices are in scope because of what sits underneath their marketing sites. PHP builds a web page on each visit, pulling details such as account information or login screens from a database and sending the result to the browser. It sits beneath WordPress, Drupal and many hosting platforms, and InvestmentNews describes it as the code behind around 70% of websites. WordPress, which runs on PHP, is a common choice for small-business sites, including advisory firms' marketing pages. Client login pages, document upload forms and scheduling tools attached to those sites could be open to attack if the server underneath has not been updated.

The larger risk may sit with vendors, since web hosts, CRM add-ons, portal providers and back-office tools often run PHP without saying so. Only versions 8.2 to 8.5 have official fixes, so a provider still on an older release has no simple update to install. A practice can update its own site but cannot update a vendor's older release.

Security firm watchTowr says its network of decoy servers recorded attempts to exploit both flaws on Wednesday. Cloudflare's chief technology officer, Dane Knecht, called the company's emergency firewall rules a "STOPGAP only". No breach at a real organization had been confirmed by Wednesday afternoon. Organizations around the world took sites offline while they waited for the fix — among them parts of Wikipedia, some Nintendo services, government portals across the Netherlands, Finland and France, and several UK council websites. Most did so as a precaution.

The National Security Agency told organizations to prepare to update, warning that flaws of this kind "often provide a direct path to the server's file system or database". Where an immediate update isn't possible, the agency advised taking the system offline.

WordPress sites have been a target before. In July, attackers went after two chained flaws in WordPress itself, dubbed WP2Shell, which allowed sites to be taken over without a login. PHP2Shell sits a layer lower, so it can affect WordPress and much of the rest of the web.

For a practice running a WordPress marketing site with a bolted-on client portal, the sequence is short: establish which PHP version sits under each one, move it to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and get the same answer from every portal, CRM add-on and scheduling vendor attached to the site. A provider still on a release older than 8.2 has no patched version to move to.