PHP flaws let attackers run code on web servers without a login (PHP2Shell), now under attack (CVE-2026-109618)

29 October 2026Critical 9.2Being exploited

PHP Group · PHP (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed) · CVE-2026-109618

PHP flaws let attackers run code on web servers without a login (PHP2Shell), now under attack

Two flaws in PHP itself, tracked as PHP2Shell, let an unauthenticated visitor run code on a server that serves PHP web requests. PHP rated both CVSS v4.0 9.2. CISA added both to its Known Exploited Vulnerabilities list on 26 October, and Amazon's threat team reports attack attempts from 17 October, before the fix was public. The second flaw is CVE-2026-109619, and CISA says both can be chained with a Linux kernel flaw (CVE-2026-46300) to reach root.

Affected: Any PHP installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk. This includes WordPress, WooCommerce and other PHP sites, and PHP bundled inside other products. PHP 8.1 and older no longer get project updates.
What to do: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or 8.6.0 RC4), starting with internet-facing servers; shared-hosting customers should ask their host to confirm it has patched. On PHP 8.1 or older, use your distribution's backport or move to a supported version. If you cannot update straight away, PHP's advisory lists partial mitigations (such as session.upload_progress.enabled=0 and a low post_max_size), but says they do not make a server safe. Check servers for odd activity back to 17 October, such as PHP workers starting shells.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Confirmed exploited and on CISA's KEV list, critical, and PHP runs a large share of the sites we and our clients build and host.

PHP flaws let attackers run code on web servers without a login (PHP2Shell), now under attack

Affected

Any PHP installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk. This includes WordPress, WooCommerce and other PHP sites, and PHP bundled inside other products. PHP 8.1 and older no longer get project updates.

What to do

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or 8.6.0 RC4), starting with internet-facing servers; shared-hosting customers should ask their host to confirm it has patched. On PHP 8.1 or older, use your distribution's backport or move to a supported version. If you cannot update straight away, PHP's advisory lists partial mitigations (such as session.upload_progress.enabled=0 and a low post_max_size), but says they do not make a server safe. Check servers for odd activity back to 17 October, such as PHP workers starting shells.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Confirmed exploited and on CISA's KEV list, critical, and PHP runs a large share of the sites we and our clients build and host.