PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution on web servers running PHP. The PHP project fixed them on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and ships no official release for PHP 8.1 and older. NSA, CISA and CERT-EU say to patch first and, if you cannot, take the system offline or isolate it. Below: how to check your version and what to do. For planning beyond the patch, see our PHP to Node.js, Java and React migration page or book a free assessment.
Status as of October 22, 2026 at 11:07 UTC
We re-read the primary sources listed below on October 22, 2026 at 11:07 UTC. The story is still moving, so treat this box as a snapshot and check the original advisories for the latest.
- Fixed releases exist. The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 (php.net). They are not installed automatically.
- Older branches. PHP 8.1 and older get no updates from the PHP project, which published only source backports for 7.4, 8.0 and 8.1 (Sophos, CERT-EU).
- Reports of exploitation differ. Sophos (advisory version 3, updated October 22) says Amazon Threat Intelligence reported an attempt on October 17, before disclosure, and other vendors have reported more since. CERT-EU says circulating proofs of concept raise the likelihood that attackers are already exploiting the flaws, but does not confirm it. CISA's alert said it had not observed exploitation when published, and neither CVE was listed in CISA's Known Exploited Vulnerabilities catalog (catalog version 2026.10.21) when we checked.
- Agency advice is consistent. NSA, CISA, the UK NCSC and CERT-EU all say patch, and if you cannot, take the system offline or isolate it until it is fixed or mitigated.
- Vendors are still shipping. Distributions, hosts and cloud platforms release packages at different speeds. Red Hat's bulletin RHSB-2026-013, for example, says some fixes are available and more are in progress.
What Is PHP2Shell and CVE-2026-109618?
PHP2Shell is the nickname the security community uses for two vulnerabilities in the PHP interpreter itself: CVE-2026-109618 and CVE-2026-109619. Unlike a plugin flaw, updating your application does not remove it. WordPress.org says no WordPress update is required or planned, since the problem is not specific to WordPress. Sansec's research says Magento, Shopware and WooCommerce stores are exposed even when their own code is clean.
The PHP project rates both flaws CVSS v4.0 9.2 (Critical). In plain terms, per its GitHub advisories: CVE-2026-109618 comes from out-of-memory handling that can interrupt PHP while internal request data is only partly set up, so cleanup treats invalid data as valid. CVE-2026-109619 comes from request state that survives after its memory is freed, so a later request on the same worker can use it. Either can lead to code execution with the web server account's privileges, without a login. This guide describes the flaws only at this level and contains no exploit details.
Why a maintenance page is not enough. The PHP project says the highest-risk setup is Apache mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. Sansec adds that the maintenance modes in Magento and WordPress do not help for the same reason: PHP parses each request before the application checks its maintenance flag.
Who found it, and when?
| Date | Event | Source |
|---|---|---|
| 2026-08-01 | Calif finds multiple remote code execution paths | Sansec |
| 2026-08-11 | First report to the PHP project; coordinated disclosure begins | Sansec, Sophos |
| 2026-08-24 | Wiz Research reports the vulnerabilities to PHP | Sansec |
| 2026-10-17 | Amazon Threat Intelligence records an exploitation attempt | Sophos |
| 2026-10-20 | Details leak before disclosure; PHP announces an upcoming security release | Sansec, php.net |
| 2026-10-21, 07:43 | Cloudflare reports early attacks | Sansec |
| 2026-10-21 | PHP releases the fixes (Sansec says 14:00; CERT-EU says 13:30) | Sansec, CERT-EU |
Sansec credits Ryan Austin of Calif, Wiz Research and OpenAI, with the PHP security team coordinating the fix. The advisory IDs are GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619).
What Do NSA, CISA, NCSC and CERT-EU Actually Say?
Each row paraphrases the agency's own page.
| Source | Date | What it asks you to do |
|---|---|---|
| NSA press release | Oct 21, 2026 | Inventory internet-facing systems that rely on PHP, prioritize vendor patches, and consider extra logging and replacing end-of-life PHP that cannot be patched. If an immediate update is not feasible, take the system offline until fully mitigated. |
| CISA alert | Oct 21, 2026 | Patch immediately, internet-facing systems first, and inventory all PHP, including PHP embedded in other software. If you cannot update immediately, or still run PHP 8.1 or earlier, take PHP-based systems offline until patched. A WAF may help meanwhile. Watch for PHP workers launching shells or downloading tools. |
| UK NCSC | Oct 21, 2026 (modified Oct 22) | Find all PHP installations, not only outdated ones, and update. If you cannot, apply the PHP project's temporary mitigations, and consider taking the system offline if those cannot be applied or would take too long. Check for compromise if you can neither update nor disable it. |
| CERT-EU 2026-018 | Oct 21, 2026 (v1.1) | Patch as soon as possible, check distribution packages, and upgrade end-of-life versions or use vendor backports. If patching is not feasible, isolate internet-facing resources until the fix is applied and verified. |
| Sophos SA-20261021-php2shell | Oct 21, 2026 (v3, Oct 22) | Informational. Interim measures are not a substitute for updating. No Sophos product is affected, but a legacy licensing portal for end-of-life SG UTM ran an affected PHP version and was taken offline. |
The pattern is clear: patching is the action, offline or isolated is the fallback when you cannot patch, and nobody calls a configuration change a fix. The PHP project's own release notices say there are no complete mitigations and that "updating is the only safe choice."
Am I Affected by PHP2Shell?
If PHP serves web requests for you and your build is older than the fixed release for its branch, assume yes until you verify otherwise. Sophos says all PHP versions before the fixed releases are affected, and CERT-EU lists every installation serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
| PHP branch | Vulnerable | Fixed in | PHP project status |
|---|---|---|---|
| 8.5 | Before 8.5.12 | 8.5.12 | Supported; security fixes until 31 Dec 2029 |
| 8.4 | Before 8.4.27 | 8.4.27 | Supported; security fixes until 31 Dec 2028 |
| 8.3 | Before 8.3.36 | 8.3.36 | Supported; security fixes until 31 Dec 2027 |
| 8.2 | Before 8.2.35 | 8.2.35 | Security fixes end 31 Dec 2026, so plan the next move |
| 8.1 | All releases | No official release; source-only backport branch | End of life since 31 Dec 2025 |
| 8.0 | All releases | No official release; source-only backport branch | End of life since 26 Nov 2023 |
| 7.4 | All releases | No official release; source-only backport branch | End of life since 28 Nov 2022 |
| 7.3 and older | Affected (Sansec: the code dates to PHP 5.4.0) | No upstream fix (AWS lists none for 5.4 to 8.1) | End of life |
The table shows what the PHP project released, not what your server runs. Ubuntu, Debian, Red Hat-family distributions and cPanel-based hosts often ship a fix under the old branch number, so a version that looks old may be patched. The next section shows how to tell.
Which setups are affected?
| Setup | What the sources say |
|---|---|
| Apache mod_php | The PHP project considers it the highest risk. The CVE-2026-109618 advisory validates it as susceptible. |
| PHP-FPM (behind nginx or Apache) | Listed as affected by PHP, Sophos and CERT-EU. For CVE-2026-109618 the advisory says source analysis indicates susceptibility but no complete exploit has been demonstrated; for CVE-2026-109619 it says code execution through the session lifecycle was validated against FPM. Red Hat calls exploitation difficult in practice on standard RHEL FPM setups. No source calls FPM safe. |
| php-cgi, FrankenPHP, LiteSpeed (LSAPI) | Listed as affected. The advisories call FrankenPHP and LSAPI susceptible by source analysis or conditionally exposed, and say FrankenPHP is not immune. |
| PHP inside other products (appliances, control panels, packaged apps) | CERT-EU, NCSC and Sophos say to confirm with each vendor. NCSC-NL keeps a public inventory of PHP-dependent software, which it says is incomplete and still growing. |
| Command-line PHP only (cron jobs, workers with no web exposure) | The advisories concern installations serving web requests, and the CVE-2026-109619 advisory says the CLI is not addressed. Update it anyway when you update the rest of the server. |
Sophos stresses runtime evidence over asset records: look for running processes named php, php-fpm, php-cgi and versioned variants such as php8.3, and confirm the version from the binary itself.
How Do I Check My PHP Version and Whether I Am Patched?
Start with who controls PHP on your site. On shared and managed hosting that is your host. On a VPS or dedicated server it is you or your administrator.
| Your setup | Where to look | Note |
|---|---|---|
| WordPress site | Tools → Site Health → Info → Server (WordPress.org) | Shows what the server runs now. Your host may still be mid-rollout. |
| cPanel hosting | MultiPHP Manager lists the PHP version each domain uses and whether PHP-FPM is on | The host decides which builds exist. Ask whether the build fixes both CVEs. |
| Managed or shared hosting | Your host's security notice, then a written question to support | Hosts differ: GoDaddy and InMotion Hosting each published separate status by hosting product on October 21 and 22. |
| Your own Linux server | php -v reports the command-line build; its output marks the SAPI, such as (cli), per php.net. Check the FPM or Apache module too | Sophos says to verify effective settings from a live web request, not the CLI. |
| Containers | Change the FROM line to a patched tag such as php:8.4.27-fpm, rebuild with --pull, recreate containers | Docker's guide: an updated image in a registry does not patch a container still running the old one. |
| Appliances and packaged products | Vendor advisory and the NCSC-NL inventory | Sophos says to confirm patch status with each vendor. |
Why a version number can mislead
Linux distributions and LTS vendors received the patches in advance (php.net) and often fix an existing package without moving to the upstream version. AlmaLinux says this plainly: its fixes are backported, so the upstream number does not change, php -v will not show the fix, and users should compare the RPM release string. These examples come from each distributor's own tracker on October 22. Check your own release.
| Distribution | Package | Listed as fixed in |
|---|---|---|
| Ubuntu 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 |
| Ubuntu 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 |
| Debian 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 |
| Debian 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 |
| AlmaLinux 9 | php:8.3 module | php-8.3.33-1.module_el9.8.0+328+1fdeb728.alma.1 |
| RHEL 8, 9 and 10 | php | See RHSB-2026-013; Red Hat says fixes are being released |
The Ubuntu and AlmaLinux rows show the trap: packages labeled 8.1.2 or 8.3.33 are patched, while an unpatched upstream 8.3.35 is not. Compare the exact package string with your vendor's advisory.
Restart, then confirm
A running worker keeps the old PHP in memory until it restarts. InMotion Hosting's guidance for cPanel servers is to run the EasyApache 4 updates and then restart Apache and PHP-FPM. One practitioner's tests (ma.ttias.be, October 22) found that mod_php needed a full Apache restart, because reload and graceful restart kept the old library loaded. If you confirm with phpinfo(), which prints configuration, server and environment details (php.net), make the test file temporary and delete it afterward.
Six Ways to Respond, Best to Last Resort
Only the first two actually remove the vulnerability. The rest buy time or reduce what is exposed.
Update PHP to a fixed release
Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from php.net or your vendor, then restart workers. The PHP project, CERT-EU, AWS and Rapid7 all call updating the only complete fix.
Install your vendor's patched package
Ubuntu, Debian, AlmaLinux, cPanel EasyApache 4 and cloud platforms publish fixes on their own schedules, sometimes under old version numbers. Match the exact package string.
Ask your host in writing
On shared or managed hosting you cannot update PHP yourself. Ask which build serves your site and whether it fixes both CVEs, and keep the reply.
Apply interim mitigations
Memory, upload and session settings plus request limits reduce exposure to specific paths. PHP, Sophos and CERT-EU all say they do not make an installation safe.
Take it offline or isolate it
NSA, CISA, NCSC and CERT-EU name this as the fallback when you cannot update. Sophos also lists network-layer authentication in front of the application.
Upgrade or re-platform old code
On PHP 8.1 or older there is no official release. Upgrading may need code changes, and for some applications a staged migration is the better long-term answer.
What to Do in the Next Few Hours
Find every PHP install and its owner
List sites and servers, including staging, containers, control panels and appliances. Check running processes, not just asset lists. Mark each as yours to patch, your host's, or a vendor's.
Install the fixed build
Use 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the package your vendor lists. Rebuild container images and recreate containers. On shared hosting, send your host a written question and track the answer.
Restart workers and verify live
Restart PHP-FPM, Apache and any long-running workers so the new build loads. Then confirm the version and settings from a request the web server handles, as Sophos advises.
Review logs, then tidy up
Check the indicators below, going back to August 1. Once patched and verified, remove blunt blocks and restore a real memory limit, as Sansec advises.
Unsure whether to patch in place or plan a bigger change? Book a free assessment.
Interim Mitigations: Not a Substitute
These measures reduce exposure to specific attack paths. They do not make an installation safe. CERT-EU, relaying the PHP project's advisory, says so, as do Sophos, Sansec, AWS and Rapid7. Use them to buy time, then update, and restart all PHP workers after any change.
| Measure | Targets | Caveat | Source |
|---|---|---|---|
| Take internet-facing PHP apps offline, or put them behind network-layer authentication such as ZTNA | Both | Listed first by Sophos; offline also blocks legitimate users | Sophos |
| memory_limit=-1, set where applications cannot override it (php_admin_value in the FPM pool or Apache config) | 109618 | Watch memory use; no pool or app setting may restore a finite limit | CERT-EU, Sophos, GitHub advisory |
| post_max_size of 8M if no uploads are needed, 32M if they are; keep upload_max_filesize below it | 109618 | Limits the size of requests PHP parses | CERT-EU |
| Request limits at the web server or proxy: decoded size, field count, multipart parts, header count, nesting depth | 109618 | Must also cover requests without a usable Content-Length | CERT-EU |
| Reject multipart/form-data requests at the web server or WAF; file_uploads=Off if you accept no uploads | Both | Breaks uploads and some cart or checkout forms; test after adding | Sophos, Sansec |
| session.upload_progress.enabled=0 in php.ini, the FPM pool or server config, then restart every worker | 109619 | Blocks confirmed session paths only; ini_set() and .user.ini are too late | CERT-EU, GitHub advisory |
| fatal_error_backtraces=0 (PHP 8.5 only), then restart every worker | 109619 | Blocks only the confirmed backtrace path | CERT-EU, Sophos |
| Fix attacker-reachable fatal errors and timeouts; remove per-request settings that print diagnostics early | 109619 | Hiding errors with error_reporting, display_errors or @ does not help | CERT-EU |
Two cautions. First, CERT-EU recommends a container or cgroup memory limit as an availability boundary and warns against RLIMIT_AS and RLIMIT_DATA, which can trigger the vulnerable allocation failure. Second, Sansec recommends a test order after blocking multipart requests and publishes ready-made nginx and Apache rules in its article.
What to keep and what to remove after patching
- Remove the multipart block and any site-wide upload block once PHP is updated (Sansec).
- Replace memory_limit=-1 with a real limit, as Sansec advises. The GitHub advisory says the patch swaps the unsafe jump for a graceful out-of-memory stop plus a hard stop that calls _exit() at a higher threshold, so watch your logs after patching.
- Consider keeping session.upload_progress.enabled=0 if your app does not use upload progress bars; the CVE-2026-109619 advisory suggests this.
- Prefer php.ini or FPM pool settings over per-directory files: the CVE-2026-109619 advisory says .htaccess and php_value settings are applied before request startup and can act as an early consumer on mod_php.
How Do I Check for Signs of Compromise?
Sophos recommends reviewing activity from August 1, 2026 onward. Its indicators:
- Web and WAF logs: multipart/form-data POST requests to endpoints that do not normally accept uploads, and requests containing the PHP_SESSION_UPLOAD_PROGRESS field. CDN and access logs often omit request bodies, so you may need WAF or application-layer logs.
- PHP and web server error logs: spikes in memory-exhaustion errors or worker crashes (segmentation faults).
- Process activity: child processes spawned by PHP or web server processes, especially shells, scripting interpreters or download utilities, compared with your normal baseline.
- Web roots: newly created or modified PHP files that could be web shells.
- Network activity: outbound connections from PHP processes to unexpected destinations.
- Authentication: successful administrative logins to affected applications since August 1.
Wiz Research adds oversized or malformed PHPSESSID response cookies and unexplained worker restarts, and notes that application logs may show little because the flaws act below the application layer. Neither CERT-EU nor Sansec publishes indicators, and Rapid7 cautions that missing log entries do not prove a system is safe.
If you find indicators, treat the server as potentially compromised. Sansec says memory disclosure can expose passwords, session tokens, API keys and TLS private keys from other requests, so consider rotating credentials the server holds. Use a qualified incident-response provider; the UK NCSC points to its assured list. MIS Services is not an incident-response firm and does not offer forensics or malware cleanup. If Google flags your site as hacked, the Search Console Security Issues help page explains the review process.
What Can a WAF or Cloudflare Do for Me?
A web application firewall is a useful extra layer, not a fix. CISA says a WAF may provide some protection until systems are patched. Cloudflare says it enabled default protections on all plans, including Free, before public disclosure, still tells customers to patch PHP, and reports that attackers were mutating payloads to get past its rules. Patchstack adds that Cloudflare's rules only help if your server accepts traffic exclusively from Cloudflare.
AWS's bulletin names specific controls: the SizeRestrictions_BODY rule in the AWS Core rule set for CVE-2026-109618, and a custom rule plus version 2.3 of the PHP managed rule group for CVE-2026-109619. It also says upgrading is the only complete fix.
In-process protection has a harder limit. Sophos says RASP and application-embedded WAF agents may not prevent exploitation, because on mod_php CVE-2026-109618 can fire before any application code runs. Sansec says its own Shield product does not protect against these paths. Treat every one of these as a stopgap.
What If I Am on PHP 8.1 or Older?
PHP 8.1 and older no longer receive updates from the PHP project, and the project's fixed releases cover only 8.2 to 8.5. CISA says organizations that cannot update immediately, or still run PHP 8.1 or earlier, should take PHP-based systems offline until patched or updated. NSA lists replacing unpatchable end-of-life PHP among its steps to consider. There are three routes:
- Vendor backport. Ubuntu lists a fixed php8.1 package for 22.04 LTS and Ubuntu Pro packages for older LTS releases, such as php7.4 on 20.04. GoDaddy and InMotion Hosting report cPanel EasyApache 4 backports for 7.4, 8.0 and 8.1. A backport belongs to the vendor's package, so confirm the exact build.
- The PHP project's source-only backports for 7.4, 8.0 and 8.1. These are minimal source branches for people who build from source or lack an LTS vendor. There are no binaries, and Sophos says to move to a supported branch.
- Upgrade to a supported branch. Version 8.3 or newer is the safer target, because php.net shows 8.2 security support ending December 31, 2026. Test first: the PHP manual publishes migration guides that list backward incompatible changes, such as Migrating from PHP 8.3.x to 8.4.x.
Sources describe the oldest branches differently. The PHP project published source-only backports for 7.4 to 8.1, while AWS's bulletin lists no upstream fix for PHP 5.4 to 8.1 and tells customers on those runtimes to migrate to a supported, fixed branch immediately. Our PHP end-of-life and upgrade guide covers the version-by-version path.
Does this mean you should leave PHP?
Patch first. Migration is not an emergency fix; it is a strategic project that takes far longer than patching. And no stack is immune. Node.js published a security release on October 21, 2026 fixing 10 vulnerabilities, 4 of them rated High, including a Brotli decoder out-of-bounds write that permits remote code execution (nodejs.org). Oracle's October 2026 Critical Patch Update contains 55 new Java SE patches, 49 of them remotely exploitable without authentication (Oracle). Moving stacks changes your risk profile; it does not remove risk. Our PHP vs Node.js comparison goes through the tradeoffs.
Migration can still be the right call when an application is stuck on an end-of-life branch with no practical upgrade path, depends on unmaintained frameworks or plugins, or your team wants a JavaScript or Java stack. Our PHP to Node.js, Java and React migration page explains an incremental approach. If you run WordPress, start with our WordPress PHP vulnerability guide.
What Can MIS Services Help With, and What Don't We Do?
Your host, administrator or software vendor normally patches PHP itself, and we will not pretend otherwise. We help with the work around the patch.
- Free 30-minute PHP architecture and migration assessment. We review what you run and what upgrading would involve, then give you a written inventory, a risk ranking and a recommendation: patch and upgrade, migrate incrementally, or rebuild.
- Upgrade and migration work. Our application development team builds web apps, internal tools and customer portals on Next.js, React, Node and Postgres.
- SEO protection during any platform change. Redirects, canonicals and sitemaps need planning when URLs or rendering change. We have been an SEO agency since 2014 and have worked with 375 clients across the U.S. See our SEO services and website optimization, or read about us.
- What we do not do. We are not an incident-response or forensics firm, we do not detect or block attacks, and we cannot guarantee that any site is secure.
Where the Facts on This Page Come From
Every fact on this page comes from a page we opened and read. We last re-read the advisories on October 22, 2026 at 11:07 UTC. Primary sources come first.
- PHP project announcements, Oct 20-21, 2026 php.net/archive/2026.php — fixed versions, mod_php wording, interim settings
- GitHub advisory GHSA-w8hw-w9fx-j79w github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w — CVE-2026-109618 details and mitigations
- GitHub advisory GHSA-6wmf-4rv5-p3rp github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp — CVE-2026-109619 details and mitigations
- PHP supported versions php.net/supported-versions.php — support end dates
- PHP end-of-life branches php.net/eol.php — end-of-life dates
- NSA press release, Oct 21, 2026 nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Articl — agency advice
- CISA alert, Oct 21, 2026 cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-re — agency advice, exploitation status at publication
- UK NCSC: critical security issue affecting PHP ncsc.gov.uk/news/critical-security-issue-affecting-php — agency advice
- CERT-EU Security Advisory 2026-018 cert.europa.eu/publications/security-advisories/2026-018/ — versions, mitigations, assessment
- Sophos advisory SA-20261021-php2shell sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell — mitigations, log indicators, exploitation reports
- Sansec: PHP2Shell research sansec.io/research/php2shell — timeline, credits, named software, server rules
- Wiz: PHP2Shell wiz.io/blog/php2shell-php-rce — discovery credit, indicators
- WordPress.org: Critical PHP Security Release wordpress.org/news/2026/10/critical-php-security-release/ — WordPress guidance, Site Health path
- WordPress Site Health screen documentation wordpress.org/documentation/article/site-health-screen/ — Info and Server tabs
- cPanel MultiPHP Manager documentation docs.cpanel.net/cpanel/software/multiphp-manager-for-cpanel/ — per-domain PHP version
- Ubuntu security: CVE-2026-109618 ubuntu.com/security/CVE-2026-109618 — fixed package versions
- Debian security tracker: CVE-2026-109618 security-tracker.debian.org/tracker/CVE-2026-109618 — fixed package versions
- Debian security announcement DSA-6574-1 lists.debian.org/debian-security-announce/2026/msg00489.html — php8.4 fix for Debian 13
- AlmaLinux: php2shell patched packages almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-10961 — package strings, backport note
- Red Hat bulletin RHSB-2026-013 access.redhat.com/security/vulnerabilities/RHSB-2026-013 — RHEL status, FPM note
- AWS security bulletin 2026-143-AWS aws.amazon.com/security/security-bulletins/2026-143-aws/ — platform status, AWS WAF rules
- Cloudflare: WAF protections for PHP vulnerabilities blog.cloudflare.com/php-vulnerabilities-waf-protection/ — WAF scope and limits
- Docker: how to fix PHP2Shell dev.to/docker/how-to-fix-php2shell-cve-2026-109618-and-cve-2026-109619 — container guidance
- NCSC-NL php2shell repository github.com/NCSC-NL/php2shell — inventory of PHP-dependent software
- Patchstack: PHP major vulnerability alert patchstack.com/articles/php-major-vulnerability-alert-10-2026/ — CDN caveat, probing telemetry
- Rapid7: CVE-2026-109618 and CVE-2026-109619 rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical- — log-evidence caution
- ma.ttias.be: how to apply the patches ma.ttias.be/php-cve-2026-109618-patch/ — practitioner restart tests
- InMotion Hosting: PHP security release inmotionhosting.com/support/news/php-critical-security-release-october — host status, cPanel steps
- GoDaddy: important PHP security update godaddy.com/resources/news/important-php-security-update-what-website- — host status, cPanel backports
- Node.js security releases, Oct 21, 2026 nodejs.org/en/blog/vulnerability/october-2026-security-releases — same-day Node.js fixes
- Oracle Critical Patch Update, October 2026 oracle.com/security-alerts/cpuoct2026.html — Java SE patch counts
- Google Search Console: Security Issues report support.google.com/webmasters/answer/9044101 — hacked-site review process
- PHP manual: Migrating from PHP 8.3.x to 8.4.x php.net/manual/en/migration84.php — upgrade checklist
- PHP manual: command-line options php.net/manual/en/features.commandline.options.php — php -v output
- PHP manual: phpinfo() php.net/manual/en/function.phpinfo.php — phpinfo scope
Frequently Asked Questions
Not sure whether to patch, upgrade or migrate?
Book a free 30-minute PHP architecture and migration assessment. You get a written inventory, a risk ranking and an honest recommendation. We are not an incident-response firm, and we will say so.
12 W Sunrise HWY, Lindenhurst, NY 11757 · Mon–Fri 9 AM – 6 PM ET
Want a Second Opinion on Your PHP Setup?
Tell us what you run and which PHP version it uses. We will reply with next steps. Prefer to read more first? See our PHP to Node.js, Java and React migration page.