If you run PHP anywhere, drop what you're doing and update it.
On 21 October 2026 the PHP team released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, already nicknamed PHP2Shell. Both are rated 9.2 out of 10, and according to the PHP team they let an attacker run code on your server without logging in. The bugs are in PHP itself, so it doesn't matter how carefully your own application is written.
The PHP team gave a day's warning before the release, which tells you how seriously they take it. Read their security advisory and the technical details on GitHub:
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Which versions to update to
- PHP 8.5.12 (announcement)
- PHP 8.4.27 (announcement)
- PHP 8.3.36 (announcement)
- PHP 8.2.35 (announcement)
Even PHP 7.4 got a fix
PHP 7.4, 8.0 and 8.1 reached end of life years ago and normally get nothing at all. This time the PHP security team made an exception and published patches for them too:
When a project goes back to patch versions it officially abandoned, the problem is serious. These are source patches only, with no ready-made releases, so if your PHP comes from a Linux distribution or a hosting provider, check with them for updated packages.
Don't put this off until next sprint. After updating, restart PHP-FPM and any long-running PHP workers, or they will keep running the old version.