NEWS | On October 21, PHP released emergency security updates for PHP2Shell, two critical flaws that could let attackers take control of a vulnerable web server without logging in. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both score 9.2 out of 10 for severity. The release came a day earlier than planned after details leaked ahead of the original October 22 disclosure.
PHP powers websites and web apps, including online stores, blogs and business platforms. One flaw involves how PHP handles a request when it runs out of memory. The other involves leftover internal data that can be used after the memory it occupied has been freed. A specially crafted web request can trigger these flaws, potentially allowing attackers to run their own code on an affected server. Security researchers demonstrated working exploits, raising concerns about attacks against exposed systems.
Patching is not simple
The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says updating is the only complete fix, and affected services may need to restart before the changes take effect. Simply checking a version number may not be enough because some Linux providers deliver security fixes without changing the displayed version number.
Older PHP versions, including PHP 7 and earlier, are also affected. The PHP project no longer officially supports PHP 8.1 and older, although some Linux providers and hosting companies may supply their own fixes. Systems without a patch remain at risk.
BMN’s view is that outdated software makes this problem harder to contain. Small businesses and website owners who depend on aging systems may struggle to upgrade, leaving vulnerable servers exposed for longer. Website owners should ask their hosting provider whether PHP2Shell has been fixed and prioritize internet-facing systems.
How many websites you use every day are still running software that attackers can exploit?
