PHP2Shell is the name of two critical vulnerabilities in the PHP engine: with a single request, no login, an attacker takes control of the server.
It hits every version from 5.4 (2012) on. The exploit is public and attacks started before the patches. The check also covers the 10 flaws Node.js fixed the same day.
Rather talk it through now? Message Alessio on WhatsApp
By the wmie technical team · Published 22 October 2026 · Updated October 22, 2026
PHP2Shell is two vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619. Researchers at Calif and Wiz found them with the help of artificial intelligence, after more than ten years in the code. Sansec and Wiz rate them 9.2 out of 10 (CVSS 4.0): a single HTTP request, no password, is enough to run commands on the server. PHP released the fixes on 21 October 2026, but Amazon had recorded a first attack attempt as early as the 17th. On that same 21 October the Finnish government, the Dutch cybersecurity agency and some French prefectures took their sites offline, Il Post reports.
In depth: what PHP2Shell is and what to do now →
Live updates · 22 October 2026
Public exploit. Sansec confirms RCE on WordPress, Magento, Drupal, Joomla and Laravel.
PHP ships the patches. Wiz publishes its analysis: CVSS 9.2.
Sites taken offline as a precaution: the Finnish government, the Dutch cybersecurity agency, some French prefectures and Wikipedia pages, according to Il Post.
Cloudflare sees the first real attacks, six hours before the patches.
watchTowr: details leaked before the embargo, the flaws are real.
Amazon's honeypots record the first exploitation attempt, four days before the announcement.
Vercel enables firewall rules for the Node.js Brotli flaw on all projects.
Node.js fixes 10 flaws, 4 high, including an RCE. No fix for 18, 20, 23 and 25.
Italy's ACN and CSIRT Italia issue alert AL07/261021: update now.
CISA (US): patch now, the flaw allows code execution without login.
The FBI's Cyber Division warns: update PHP now.
NSA: all organizations using PHP should prepare for an immediate update.
Japan's prime minister Takaichi Sanae asks on X to act "tonight": 350,000 likes.
NCSC (UK): take offline any server that cannot be updated right away.
pixiv takes its service down for four and a half hours of emergency maintenance.
Cloudflare enables WAF rules for every customer, Free included.
Posts and advisories published since 20 October by security agencies, governments and companies: each entry links to the original source.
Prime Minister of Japan
皆様に、今夜に対応して頂きたい大至急のお願いです。 多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。…
Show more on XTranslated from Japanese
An extremely urgent request to all of you: I'd like you to take action tonight. Regarding PHP, which is used by many websites, the PHP security team has issued a warning about two serious vulnerabilities.…
Japanese platform for illustrators
[Emergency maintenance announcement] To ensure the security of our services, we will be performing emergency maintenance during the following period. ■ Date and time From Wed., October 21st 7:00 pm JST to the early hours of Thurs., October 22nd (scheduled) *Estimated…
Show more on XReplies29Likes1,156
Japanese platform for illustrators
【緊急メンテナンス終了のお知らせ】 本日実施しておりました緊急メンテナンスは、10月21日（水）23:30に終了いたしました。 現在、対象サービスをご利用いただけます。 ご利用のお客様にはご不便をおかけしましたことをお詫び申し上げます。 ご協力いただき、ありがとうございました。
Translated from Japanese
[Notice: emergency maintenance has ended] The emergency maintenance carried out today ended at 23:30 on Wednesday, October 21. The affected services are available again. We apologize for the inconvenience to our users. Thank you for your cooperation.
US National Security Agency
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
Show more on XReplies1,164Likes64,350
FBI Cyber Division
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially…
Show more on XReplies373Likes23,376
US cybersecurity agency
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi
Replies47Likes1,842
UK National Cyber Security Centre
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ ncsc.gov.uk/news/critical-…
Replies74Likes3,411
CTO of Cloudflare
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show…
Show more on XReplies86Likes5,327
Security research firm
We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available.
Replies21Likes720
CEO of Vercel
Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release. All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.
Replies92Likes1,815
Polish Armed Forces Cyber Command
W związku z pojawieniem się informacji o podatnościach CVE-2026-109618 oraz CVE-2026-109619 związanych z PHP (podatne są wszystkie wersje od 5.4) zalecamy wszystkim podmiotom wykorzystującym tę technologię jej niezwłoczną aktualizację. Wymienione podatności umożliwiają zdalne…
Show more on XTranslated from Polish
Following reports of vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PHP (all versions from 5.4 are vulnerable), we recommend that all entities using this technology update it without delay. The listed vulnerabilities allow remote…
Japan's Ministry of Internal Affairs
昨晩、国家サイバー統括室（NCO）からPHPの脆弱性について注意喚起が行われました。 WebサイトやWebシステムを運営・管理する事業者等の皆様は、速やかに必要な対策をお願いします。 ※一般のインターネット利用者の皆様に、特段の対応を求めるものではありません。
Translated from Japanese
Last night the National Cyber Office (NCO) issued a warning about the PHP vulnerability. Operators who run websites and web systems are asked to take the necessary measures promptly. * No particular action is asked of ordinary internet users.
The examined path does not represent every application, webmail service, PHP pool or node. Examine each authorized runtime separately.
We check all of it
We list everything that runs on PHP, update the servers and give you the list of what we fixed.
PHP released the fixes on 21 October 2026. For 7.4, 8.0 and 8.1 there are only backported patches, to build yourself or get from your provider. The same day Node.js updated the 22, 24 and 26 lines.
| Branch | First fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No official release |
| Node.js 26 | 26.12.1 |
| Node.js 24 | 24.22.1 |
| Node.js 22 | 22.23.4 |
| Node.js 25, 23, 20 and 18 | End of life, no fix |
The check collects clues even when the PHP version is hidden. These clues alone do not confirm a vulnerability.
Your hosting provider can apply security fixes without changing the version number. Ask them to confirm the updates applied to your website.
Your provider can identify the PHP version your website actually uses and confirm whether it includes the necessary fixes.
Given the urgency we opened a direct channel with Alessio on WhatsApp. We check your site and everything that runs on PHP: back office, e-commerce, webmail. We tell you what to update and take care of it.