PHP developers rushed out emergency security patches after news of two major security holes leaked online, sending alarm bells through the web community. Hackers didn’t waste any time—they started poking at these vulnerabilities almost right away. Dubbed “PHP2Shell,” the bugs (tracked as CVE-2026-109618 and CVE-2026-109619) let attackers run code on a server without even needing to log in. That’s about as bad as it gets.
To contain the damage, the PHP team told everyone to update fast and pushed out fixes in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
So, what exactly went down? On October 21, details about these vulnerabilities hit the internet earlier than planned. Within hours, developers hustled emergency patches out the door. The main worry: anyone who hadn’t patched yet was wide open to remote code execution—meaning hackers could grab control of their servers.
These vulnerabilities hit pretty much any PHP setup handling web traffic—think PHP-FPM, mod_php for Apache, php-cgi, FrankenPHP, LiteSpeed… the list goes on.
PHP sits underneath a huge chunk of the web. Lots of CMS platforms and online stores rely on it, so security teams everywhere scrambled to check what was at risk—government sites, hospitals, schools, private companies—everyone.
In response, some organizations yanked sites offline while they figured out if they were exposed. In Finland, for example, the National Land Survey’s site vanished for a bit. Over in the Netherlands, sites tied to parliament and cybersecurity bodies went dark too, just to be cautious.
Other high-profile spots like Pinboard, as well as bits of Wikipedia, 4Chan, and Something Awful, also went offline while their admins patched things up.
All these shutdowns underline the stakes here. If someone exploits the flaw, they can run commands on the web server—steal data, deface the site, plant malware, or use your site as a springboard for more attacks.
There’s already evidence hackers knew about the bug before the news broke. Amazon’s security team spotted an attempted attack on one of their honey pots back on October 17. That suggests some bad actors had a heads-up before the official disclosure. Amazon even faced several attacks in the days leading up to the public announcement. Cloudflare also reported seeing attackers trying different ways to sneak past defenses.
Security agencies, including the NSA, warned anyone who couldn’t patch right away to take vulnerable servers offline until they could be protected.
Now, who needs to worry? The PHP Foundation’s fixes only cover versions 8.2 and newer. If you’re still running 8.1 or anything older, you won’t get these patches—you’ll have to upgrade.
Here are the patched versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Anyone running a website or hosting provider should check their servers, update to the right version, reboot web services as needed, and double-check that their sites still work after the fix. If you’re using managed hosting, make sure your provider updated their PHP as well.
Why the rush? These bugs scored 9.2 out of 10 for severity. The vulnerabilities reach all the way back to PHP version 5 from 2004, though only currently supported branches are getting the new fixes. Here’s the scary part: hackers can exploit them without even needing an account, the technical write-up leaked before most people could patch, and we already see attackers actively targeting real systems.
For India, where so many government sites, news outlets, e-commerce pages, and schools run on PHP, the job is clear—patch every PHP server you’ve got and check your web applications. Don’t just trust a firewall or a CDN—the hole is in the PHP runtime itself.
What’s next? Security teams are watching to see if these targeted attacks balloon into automated, large-scale exploits. The big question is: can everyone patch fast enough before hackers swarm in?
In the meantime, PHP’s message is as simple as it gets: update now. And if you can’t patch right away, take anything exposed offline. Don’t gamble with this one.
