PHP2Shell: Two Critical Vulnerabilities Show Why Web Security Needs Ongoing Maintenance
On October 21, 2026, the PHP project released updates for two vulnerabilities that can allow remote code execution under certain conditions. What businesses running websites and web applications should check.
A website can be online, easy to navigate, and appear to work perfectly. That alone does not tell you whether the software running it is up to date.
That distinction became tangible with PHP2Shell, the name used for two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project released security updates. Under certain conditions, the vulnerabilities can allow an unauthenticated attacker to execute code remotely. The PHP project assigns both a CVSS v4.0 score of 9.2 out of 10.
This does not mean every PHP website has been compromised. It means exposed installations need to be identified and updated, taking into account how PHP is installed and managed.
The issue is in the runtime
PHP is the language and execution environment behind many web applications. The two vulnerabilities affect internal parts of the runtime: one involves handling out-of-memory conditions; the other involves internal data that can remain associated with memory that has already been freed. In specific scenarios, these flaws can lead to arbitrary code execution.
For website owners, the practical point is that risk does not depend only on the site’s code or the CMS it uses. The PHP version actually running, the server configuration, and the installation type also matter. The PHP project lists web-facing installations among the affected environments, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It also identifies Apache mod_php as the higher-risk configuration.
That is why checking whether the homepage loads, or whether the site itself was recently updated, is not enough. The hosting environment needs to be checked too.
Updating is the primary measure
Fixes were released in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. If you use packages managed by a Linux distribution, hosting provider, or control panel, check that vendor’s guidance: fixes may be delivered through vendor-specific packages with different version numbers or build identifiers.
An operational review can start with four questions:
- Which websites, applications, and business environments run PHP, including less visible systems or those managed by third parties?
- Which PHP version and build are actually running on internet-facing servers?
- Is a fixed release or a vendor-verified patch available and installed?
- After updating, were the PHP processes restarted and the fix verified in the live environment?
The PHP project’s guidance identifies upgrading to a fixed release as the complete mitigation. Temporary measures may reduce some attack paths when an immediate update is not possible, but they do not replace the patch. Coordinate the work with your hosting provider or whoever administers the servers and applications, especially when infrastructure is managed externally.
Maintenance is part of the project
PHP2Shell highlights a responsibility that remains relevant after this specific vulnerability is resolved: a website is not a static asset whose lifecycle ends at launch. It depends on runtimes, servers, components, and services that evolve and need ongoing checks.
For a business, security management can include keeping an inventory of environments, planning updates, assigning clear responsibility for third-party platforms, and checking systems after each change. These are not tasks to begin only when a vulnerability becomes headline news; they are part of maintaining a digital service.
If you do not know which PHP version your website runs, ask your hosting provider or technical contact to check the version, build, and patch status. The useful question is not only “Is the website working?” but also “Is the software behind it up to date, and who is responsible for maintaining it?”
Web security starts with understanding the infrastructure and continues with updates that can be verified over time.
