PHP2Shell: PHP patches two critical flaws already facing exploitation attempts

On 21 October PHP released emergency patches for PHP2Shell, two critical flaws (CVSS 9.2) that let an attacker without an account run code on a web server. They affect PHP sites such as WordPress or PrestaShop, even if their own code is secure. Update today to 8.5.12, 8.4.27, 8.3.36 or 8.2.35: exploitation attempts have begun.

Key facts

• The flaws are CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The first corrupts memory when it runs out while parsing input under RFC 1867. The second corrupts global state after a fatal error.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything lower in each branch is vulnerable.
• They affect almost every PHP version back to 5.4. INCIBE-CERT says all versions could be affected and that testing covered only versions 5 to 8.
• watchTowr reported active exploitation attempts against both flaws at 14:19 UTC on 21 October, according to SecurityWeek. At that point no intrusion had been confirmed and neither flaw was in CISA's KEV catalogue.
• Spain's CCN-CERT issued alert AL 11/26 at critical level. INCIBE-CERT rates it importance 5 (critical).

Am I affected if my site runs WordPress, PrestaShop or custom code?

Yes, if it runs on PHP. The flaw is in the language, not in your application. Sites are exposed even when their own code is secure: WordPress, WooCommerce, PrestaShop, Magento, Laravel and custom builds. And it's not only the website. Your CRM, customer portal or intranet count too, if they use PHP.

The highest risk is on Apache servers with mod_php. According to The Hacker News, a single unauthenticated request there triggers the attack before any application code runs. On PHP-FPM, the second flaw also achieved code execution, but that path depends on an operation inside the running application.

There is an extra risk: the flaws can be used to read process memory, which may hold credentials and API keys.

What if my server runs an older PHP version?

That's the trickiest case. Before the release, INCIBE-CERT announced backported patches for branches 7.4, 8.0 and 8.1. But The Hacker News's table of fixed versions only lists 8.2 to 8.5. Check PHP's official advisory to confirm whether your branch has a patch. If you have a legacy server on a branch with no fix, assume it is exposed.

Is Cloudflare or a WAF enough?

No. Details leaked a day before the planned 22 October disclosure. Cloudflare switched on default protection rules before the patch, but admits they are only a stopgap. They buy you hours. They don't replace updating.

What to do today

1. Ask your hosting provider or IT person which PHP version your servers run and whether 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is already installed. On shared or managed hosting, get the confirmation in writing.
2. Make the list: website, online shop, CRM, customer portal, intranet. Anything running PHP goes on it.
3. If you can't update yet, apply the temporary mitigations. For CVE-2026-109618: memory_limit=-1 and limits on post_max_size and request size at the web server or proxy. For CVE-2026-109619: session.upload_progress.enabled=0 and restart all workers. Neither fully mitigates the flaw.
4. Shut down exposed services that aren't essential, as CCN-CERT recommends. Turn on your WAF or Cloudflare rules if you have them.
5. After updating, review access logs from 17 October onwards for unusual requests. If there are signs of compromise, rotate API keys and credentials for the exposed applications.

What it means for a small business

This one goes ahead of every other alert this week. Many critical flaws hit a product you may not use. This one hits the base component of a large share of Spanish small-business websites, and chances are you don't know which PHP version you run.

A patch existing doesn't mean it's installed. On shared hosting you depend on your provider. On your own server or a VPS, on whoever maintains it. If nobody can tell you today the exact version on each server, that's the underlying problem, beyond PHP2Shell.

The real weak spot is legacy systems: the old website nobody touches, the intranet still on an old branch. Mitigations and a WAF buy time. The real decision is to migrate, isolate or switch off. If you need help building that inventory and setting priorities, talk to our cybersecurity team.

FAQ

Are there confirmed attacks?

watchTowr detected active exploitation attempts on 21 October. As of that update, no source had confirmed a specific intrusion.

If my code is secure, am I still at risk?

Yes. The flaw is in PHP, not in your application.

Which version should I be on?

8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. For older branches, check PHP's official advisory for a patch.

Sources

• CCN-CERT – Alerta CCN-CERT AL 11/26: actualización inmediata de vulnerabilidad crítica en PHP
• INCIBE-CERT – Múltiples vulnerabilidades en PHP
• The Hacker News – PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
• SecurityWeek – PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors