PHP has released emergency security updates for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, commonly called php2shell, after evidence that attackers began exploiting them before the fixes were published. Both flaws carry a CVSS severity score of 9.2 out of 10 and can allow unauthenticated attackers to execute code on vulnerable servers.

What was fixed, and when

The fixes were released on 21 October 2026 in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon Threat Intelligence observed an exploitation attempt on 17 October and has since reported broader exploitation in the wild, according to a Kocho security bulletin. Details of the vulnerabilities began circulating publicly before PHP released its updates, which prompted an accelerated response from the PHP security team.

Who is at risk

The flaws sit inside the PHP runtime itself, not in a single application or framework, so application-level controls do not remove the exposure. PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php considered the highest-risk configuration. Legal analysis by Wolf Theiss notes the flaws went unnoticed for more than a decade, were uncovered with the help of artificial intelligence tools, and may have exposed millions of websites, with governments and businesses temporarily taking sites offline after authorities advised immediate patching or disconnection.

What to do

Site owners should update to a fixed PHP version as a priority and check for signs of compromise, since exploitation began before disclosure. The Daily Byte's own site runs on PHP, which is why this story matters to readers who run websites as well as to those who simply use them. Sources: Kocho; Wolf Theiss.