Website Without PHP

PHP2Shell: what we know

Last checked:

Status: fixed releases available, update now

This page lists only confirmed facts, each with its source and the time we checked it. We update it when a primary source changes. We do not repeat unconfirmed claims.

Does your site run an affected PHP version?

Enter your domain. We read only the public headers your site already sends: no scan, no login. We keep the domain and the result, never your IP address.

Need help? Go to the form

In short: confirmed facts

Live timeline

Every moment from the first signal onwards, newest first. Each entry shows its source and status.

  1. Confirmed CISA (ADP Vulnrichment)

    CISA adds its assessment

    CISA added an SSVC assessment to both CVE records: exploitation none, not automatable, technical impact total. CISA also linked the Wiz blog as a third-party advisory.

    Source: cve.org CVE Services API (CISA-ADP) · checked

  2. Confirmed NVD (NIST)

    NVD receives the records

    NVD added both CVEs with status Received. NVD has not published its own analysis yet.

    Source: NVD CVE API 2.0 · checked

  3. Reported BleepingComputer (Sergiu Gatlan)

    BleepingComputer covers the release

    BleepingComputer reported the emergency patches for the two flaws tracked as PHP2Shell and advised admins to install the fixed versions as soon as possible.

    Source: BleepingComputer · checked

  4. Confirmed CISA

    Not in CISA's KEV catalog

    The KEV catalog version released at 14:04 UTC does not list CVE-2026-109618 or CVE-2026-109619. Exploitation in the wild is not confirmed by CISA.

    Source: CISA Known Exploited Vulnerabilities catalog · checked

  5. Reported Wiz Research

    Wiz publishes PHP2Shell

    Wiz published its research under the name PHP2Shell, with a disclosure timeline and thanks to the PHP team, Calif and OpenAI. Wiz says nearly every PHP version back to 5.4 is affected by at least one issue.

    Source: Wiz Blog · checked

  6. Reported Cloudflare

    Cloudflare names the researchers

    Cloudflare wrote that Calif.io, Wiz, OpenAI and Quarkslab disclosed the two flaws known as php2shell, and that it had worked with the PHP Foundation, OpenAI and Wiz on mitigations. It still tells customers to patch.

    Source: Cloudflare Blog · checked

  7. Confirmed Ubuntu Security

    Ubuntu ships PHP updates

    Ubuntu published USN-8948-1 for both CVEs and rates them critical. At our check, php8.1 on 22.04 (jammy) and php8.3 on 24.04 (noble) were marked as released.

    Source: Ubuntu Security Notice USN-8948-1 · checked

  8. Confirmed PHP Group (CNA)

    CVE-2026-109619 published

    The CVE record "RCE via stale global state" went public with the same score and the same affected version ranges. Credits name Wiz, Ryan at Calif.io and OpenAI as reporters.

    Source: cve.org CVE Services API · checked

  9. Reported Help Net Security (Mirko Zorz)

    First press reports of the fix

    Help Net Security reported that the fixes were out and repeated php.net's advice to update immediately. It also mentioned the UK NCSC urging organisations to patch.

    Source: Help Net Security · checked

  10. Confirmed PHP Group (CNA)

    CVE-2026-109618 published

    The CVE record "RCE via OOM corruption" went public with CVSS v4.0 9.2 (critical). Affected: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12.

    Source: cve.org CVE Services API · checked

  11. Confirmed Debian Security Team

    Debian fixes php8.4 in trixie

    Debian released DSA-6574-1 with php8.4 version 8.4.27-1~deb13u1 for the stable release trixie. At our check, the Debian tracker still marked php8.2 in bookworm as vulnerable.

    Source: Debian Security Advisory DSA-6574-1 · checked

  12. Confirmed PHP security team

    GitHub advisories published

    PHP published GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) at 13:34:13 UTC and GHSA-w8hw-w9fx-j79w (CVE-2026-109618) at 13:34:25 UTC, both rated critical. Both list 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched versions.

    Source: GitHub Security Advisories, php/php-src · checked

  13. Confirmed PHP project

    PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35

    The release announcements and the security advisory were merged into the php.net website code at 12:59 UTC, ahead of the planned 14:00 UTC. php.net says the versions fix two critical flaws that can allow unauthenticated remote code execution, and urges everyone to update immediately.

    Source: php.net news archive en GitHub php/web-php · checked

  14. Reported CloudLinux (Imunify360)

    Hosting software vendor ships a stopgap rule

    CloudLinux said its Imunify360 ruleset 8.83 blocks the publicly circulating exploit pattern on Apache, as an interim measure only. Updated alt-php and ea-php packages would follow the upstream release.

    Source: CloudLinux Blog · checked

  15. Reported NCSC (Nederland)

    Dutch NCSC opens an information page

    The Dutch National Cyber Security Centre started a public page on GitHub. It said it had no indication of active exploitation yet, but expected large-scale exploitation in the short term.

    Source: NCSC-NL op GitHub · checked

  16. Reported NOS

    Dutch sites go offline as a precaution

    NOS reported that organisations in the Netherlands were taking websites offline as a precaution, starting with NotuBiz, a meeting platform used by about a hundred municipalities. The article was updated later in the day.

    Source: NOS · checked

  17. Reported Tenable

    Tenable publishes its FAQ

    Tenable summarised what was known before the patch, including the CERT-EU advisory and the expected fixed versions. It noted that exploit code circulating online was unverified and may contain malware.

    Source: Tenable Blog · checked

  18. Reported SecurityWeek (Ionut Arghire)

    SecurityWeek reports the leak

    SecurityWeek reported that details of two critical PHP flaws called PHP2Shell had leaked before coordinated disclosure. It wrote that public reporting uses the name PHP2Shell, and that watchTowr and Huntress had not seen exploitation in the wild.

    Source: SecurityWeek · checked

  19. Reported Plesk

    Plesk will ship patched packages

    A Plesk community manager wrote on the Plesk forum that fixed PHP versions will be added to Plesk PHP packages once released, without a firm date yet.

    Source: CMS ADMINS (citeert het Plesk-forum) · checked

  20. Reported Cloudflare

    Cloudflare switches on WAF rules

    Cloudflare says customers on its free and paid WAF plans were protected by default from 03:02 UTC, about nine hours before public disclosure. Cloudflare calls this extra protection, not a replacement for updating PHP.

    Source: Cloudflare Blog · checked

  21. Reported Alexandre Daubois (PHP security team)

    Inside view: the embargo broke early

    PHP security team member Alexandre Daubois wrote that the embargo broke in several places on 20 October, and that PHP moved the release a day earlier because of it. He also warned that the most shared php.ini tip only covers one of the two bugs.

    Source: daubois.dev · checked

  22. Reported OpenAI

    OpenAI describes the coordination

    OpenAI wrote that it led a coalition of maintainers, researchers and security providers over two months, that Calif found a flaw using an OpenAI model, and that Wiz found and reported both flaws independently. OpenAI says applying the fixes is the priority now.

    Source: OpenAI · checked

  23. Reported Calif (Ryan Austin)

    Calif publishes its write-up

    Calif published its account of the two flaws, which it says were found by Calif, OpenAI and Wiz. It was shared on Hacker News at 13:56 UTC and ends with one message: patch.

    Source: Calif Research · checked

  24. Reported BSI (Duitsland)

    German BSI issues a warning

    Germany's federal cyber security agency published a warning about both CVEs, based on the PHP advance notice. Kevin Beaumont linked to it at 11:40 UTC.

    Source: BSI Cybersicherheitswarnung · checked

  25. Reported watchTowr

    First FAQ for defenders

    watchTowr published a FAQ on the two CVEs. It said the official disclosure had been expected on 22 October.

    Source: watchTowr Intelligence · checked

  26. Confirmed PHP security team

    php.net announces an emergency release

    php.net announced a security release for Wednesday 21 October at 14:00 UTC for two critical flaws, both CVSS v4.0 9.2. The team reserved the right to release earlier if details became public or exploitation appeared.

    Source: php.net news archive · checked

  27. Reported Kevin Beaumont

    Researcher flags a leak

    Security researcher Kevin Beaumont posted that someone had leaked both CVE numbers before a patch was out. CERT-EU later cited this post in its advisory.

    Source: Mastodon (cyberplace.social) · checked

  28. Reported Anonymous poster on Hacker News (petecooper)

    First public signal

    A Hacker News post citing an unnamed source warned of two PHP remote code execution flaws and named both reserved CVE numbers. It said an announcement was planned for 22 October.

    Source: Hacker News · checked

  29. Reported CERT-EU

    CERT-EU advisory 2026-018

    CERT-EU advised organisations to prepare for immediate patching and, where that is not possible, to consider taking internet-facing PHP applications off public networks until a fix is in place. The page lists a release time of 20:33 without a time zone.

    Source: CERT-EU Security Advisory 2026-018 · checked

  30. Confirmed PHP release managers

    Release versions tagged

    The release managers tagged the fixed versions in the PHP source repository: 8.2.35 at 07:30 UTC, 8.3.36 at 14:00 UTC, 8.4.27 at 14:44 UTC and 8.5.12 at 17:04 UTC. The tags were prepared two days before the public release.

    Source: GitHub php/php-src (git tags) · checked

  31. Confirmed PHP Group (CNA)

    Two CVE numbers reserved

    The PHP Group reserved CVE-2026-109618 at 21:03 UTC and CVE-2026-109619 at 21:04 UTC. A reserved number carries no public details until the record is published.

    Source: cve.org CVE Services API · checked

  32. Reported PHP security team (according to Wiz)

    PHP starts on a coordinated fix

    Wiz writes that the PHP project acknowledged the reports on this day and began work on a coordinated fix. php.net itself does not give this date.

    Source: Wiz Blog · checked

  33. Reported Wiz Research

    Wiz reports to the PHP security team

    According to the Wiz disclosure timeline, Wiz Research reported the vulnerabilities to the PHP security team on this day.

    Source: Wiz Blog · checked

  34. Reported Wiz Research

    Wiz finds the flaws independently

    Wiz Research writes that it found the first PHP vulnerability on 19 August with help from AI tools, and reported its findings to the PHP security team on 24 August.

    Source: Wiz Blog · checked

  35. Reported Calif

    First report to PHP

    Calif says it reported the first bug to PHP on this day and started coordinated disclosure. According to Calif, PHP confirmed on 15 August that the demonstration worked.

    Source: Calif Research, php2shell write-up · checked

  36. Reported Calif

    Calif finds the first paths

    According to its own timeline, security firm Calif found several independent paths in PHP that could lead to remote code execution. It reported the first bug to the PHP project on 11 August and the second on 21 August.

    Source: Calif Research, php2shell write-up · checked

Still unknown

What you can do now

  1. Check which PHP version each of your sites runs. Your hosting panel or a phpinfo page shows it.
  2. On PHP 8.2 to 8.5: update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or ask your hosting provider when they do.
  3. On PHP 8.1 or older: the PHP project no longer ships updates. Ask your vendor for a backported fix, or plan an upgrade to a supported version.
  4. If you cannot update today: php.net lists temporary settings that reduce exposure but do not make a site safe. Use them only as a stopgap.
  5. Make a fresh backup of files and database before you update.

Make Website Without PHP a preferred source in Google

With Google Preferred Sources you choose which sites show up first in Top Stories. Add us and new PHP2Shell updates reach you sooner.

Add Website Without PHP to Google (opens in a new tab)
More information

Google opens a page where you tick the sites you prefer. You need to be signed in to Google. You can remove us there at any time.

Ask your AI about this page

Opens your assistant with this page and a short question. We see nothing of what you ask.

Frequently asked questions

What is PHP2Shell?

The press uses this name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. According to php.net they can allow unauthenticated remote code execution.

Which PHP versions are affected?

According to the CVE records published by the PHP project: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. PHP 8.1 and older no longer receive updates from the PHP project; php.net published source backports for 7.4, 8.0 and 8.1. Treat those older versions as affected.

Which versions fix it?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.

Are the vulnerabilities being exploited?

php.net mentions a demonstrated exploit, a proof that the attack works. php.net and CISA have not reported exploitation in the wild, and the CISA Known Exploited Vulnerabilities catalog does not list them at our last check.