PHP has updates that fix two flaws

This page is about two flaws in PHP. It sums up what four sources published, in our own words. They are the PHP project, the Cybersecurity and Infrastructure Security Agency, Tenable and Rapid7. Each fact we took from them names its source. The full list of sources, with the dates they were published, is at the end.

What happened

The PHP project said on Wednesday, October 21, 2026 that new versions of PHP fix two flaws it calls "critical." It said the flaws can let someone over the internet run their own instructions on a computer running PHP, without signing in.

What this means for you

The PHP project's notice lists who is at risk as "all PHP installations serving web requests." In plain words, that is PHP on a computer that sends out web pages.

A household with its own website, kept by a hosting company, will find a section for it near the end of this page. A hosting company keeps websites on its own computers.

What PHP is

PHP is a programming language: a way of writing the instructions a computer follows. Websites can use it on the server side. That means on the website's own computer, which builds each page and sends it to the reader's screen.

Tenable said on Wednesday, October 21, 2026: "PHP is used by 69.3% of websites whose server-side language is known." That figure covers only websites whose language is known.

The detail

The two flaws

The PHP project lists two flaws, with the tracking numbers CVE-2026-109618 and CVE-2026-109619. In its advance notice of Tuesday, October 20, 2026, the PHP project rated both 9.2 on a scoring system called CVSS, version 4.0. Tenable called the pair "php2shell."

Who is affected

The Cybersecurity and Infrastructure Security Agency said on Wednesday, October 21, 2026 that the flaws "affect all PHP installations serving web requests." The PHP project says the same, and names several common ways of setting PHP up. Tenable says the earliest affected code that was found dates back to PHP 5.4.0.

The fix

The PHP project and the Cybersecurity and Infrastructure Security Agency both name the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project says some groups that package PHP for others received the fixes in advance.

The PHP project lists some measures that reduce exposure to some kinds of attack, and says they do not make an installation safe. On each new version it says: "There are no complete mitigations, updating is the only safe choice."

Older versions

The PHP project says PHP 8.1 and older no longer get updates from the PHP project. For these flaws, its security team provided small code fixes for PHP 7.4, 8.0 and 8.1, which it calls "minimal source-backports." It also says PHP 8.2 gets no security fixes after Thursday, December 31, 2026.

A test version

The PHP project says its test version, PHP 8.6.0 RC4, also contains the fixes. It asks people not to use that version in production, which means on a live website.

Who found the flaws

Tenable reports that the PHP Foundation credited several groups, Wiz among them, for their research and for reporting the flaws. Tenable says Wiz and one other group have each reported using AI models as part of their research.

What is known about attacks

The sources differ here. Each view is set out below, and we do not choose between them.

• The Cybersecurity and Infrastructure Security Agency said on Wednesday, October 21, 2026 that it had not seen the flaws used in attacks when it published.
• Tenable's page, published Wednesday, October 21, 2026, says Amazon Threat Intelligence saw an attempt to use the flaws on Saturday, October 17, 2026. That was four days before the flaws were made public. Tenable also reports Amazon's view that php2shell "is now being broadly exploited in the wild," meaning used widely in real attacks.
• Rapid7's page, published Wednesday, October 21, 2026, says Rapid7 had not seen the flaws used in real attacks. It also says there are several reports of attempts, and that use in real attacks is expected.

What is known about working attack code

The sources differ here too. Each view is set out below, and we do not choose between them.

• Tenable's page, published Wednesday, October 21, 2026, reports that the PHP Foundation did not find any working attack code when the flaws were made public. Tenable also says code that claims to use the flaws is being shared publicly.
• Rapid7's page, published Wednesday, October 21, 2026, says several public "proof-of-concept" exploits are now available. A proof of concept is code written to show that a flaw can be used.

If you have your own personal or family website

This section is for a website a household keeps for itself with a hosting company.

The PHP project's notice says: "Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages."

In plain words, a vendor here is a group that packages PHP for others to use. LTS stands for long-term support. Updated packages are new copies of PHP that hold the fixes. The PHP project's sentence does not say whether a hosting company counts as a vendor.

Where this comes from

The PHP project, security notice
Published Wednesday, October 21, 2026. Advance notice published Tuesday, October 20, 2026.
https://www.php.net/

The Cybersecurity and Infrastructure Security Agency, alert
Published Wednesday, October 21, 2026.
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

Tenable, questions and answers
Published Wednesday, October 21, 2026.
https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

Rapid7, article
Published Wednesday, October 21, 2026.
https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/

We read these pages on Thursday, October 22, 2026. They may have changed since.