PHP Vulnerability News: What Users Need to Know Today

A website can need an urgent security update even when its own pages and plugins appear current. A PHP vulnerability can reside in the server runtime, outside the application’s own update process. Two serious flaws in PHP’s core runtime may put exposed systems at risk.

PHP runs on a web server and helps build dynamic websites and applications. The site’s pages may look normal while the software that processes requests remains vulnerable. That gap matters because an attacker may target the server itself, putting data and infrastructure at risk.

Operators need to check and update the PHP runtime behind affected services. People who use those services should follow the service operator’s security notices and protect accounts if advised. Site owners should verify the PHP runtime, not assume that an application update has covered it.

What the PHP Vulnerability Allows Attackers to Do

PHP2Shell is a pair of core-runtime flaws that can let an unauthenticated attacker run code on an affected server. The two critical vulnerabilities are CVE-2026-109618 and CVE-2026-109619, which affect memory handling during requests.

An out-of-memory (OOM) error is a condition in which PHP cannot allocate enough memory to complete a task. Vulnerable error handling can leave parts of a request’s memory in an unsafe state. An application does not need to contain its own coding flaw for its server’s PHP runtime to be exposed.

How memory errors can become code execution

CVE-2026-109618 involves an OOM error-handling flaw. During recovery, the function longjmp() can leave request memory uninitialized. A remote attacker may exploit that state to make the server execute code without authentication.

Security firm watchTowr rates CVE-2026-109618 at CVSS 9.2 under CVSS v4.0. Its technical analysis of the memory flaw describes how an error during request handling can create a path to code execution.

CVE-2026-109619 uses a different memory failure. Global memory can point to regions that PHP has already freed. A later read or branch based on that stale pointer may let an attacker execute arbitrary code.

A separate PHP library flaw uses a different attack

Memory disclosure can also expose information that should remain private. Depending on the affected process and data, an attacker may recover passwords, access tokens, or API keys. Those details can create further risk for systems connected to the server.

The PHP vulnerability CBC concern refers to CVE-2026-32935, a separate issue in phpseclib, a PHP secure communications library. It involves an AES Cipher Block Chaining (CBC) padding-oracle timing attack that may let a remote attacker decrypt sensitive information.

Red Hat Product Security says CVE-2026-32935 does not affect any currently supported Red Hat product. It is not one of the two PHP2Shell flaws. A phpseclib CBC padding-oracle concern is a separate issue and should not be confused with PHP2Shell.

How Widespread Is the PHP2Shell Risk Today?

PHP’s reported use on 69.3% of websites with a known server-side language helps explain why the alert reached far beyond individual applications. W3Techs reports that figure for October 2026, and says PHP version 8 powers 65.3% of websites using PHP.

PHP runs on the server, where it can generate pages and handle requests. Platforms such as WordPress, Drupal, Joomla, and MediaWiki use it. A platform’s presence alone does not show whether its server has a vulnerable runtime or whether an attacker has gained access.

The W3Techs website-use figures describe PHP’s reach, not the number of exposed systems. A site may use a patched runtime, a vendor-managed package, or a version that is not affected. Each operator needs to identify the PHP version actually running.

PHP’s reach across websites and applications

WordPress is one familiar example, but PHP also supports many other web applications. Readers building a site can find practical platform basics in this WordPress website setup guide. The security question is separate: which PHP runtime serves that installation?

Researchers from Wiz and Calif used AI tools in vulnerability discovery and exploit work. The tools were part of their research process, not the cause of the flaws. PHP’s memory-handling behavior, rather than the use of AI, is the underlying security issue.

What exploitation reports do and do not show

By October 21, 2026, watchTowr reported observing exploitation of both flaws through its honeypot network. A honeypot is a system set up to attract and record attempted attacks. The observation indicates activity, but does not establish successful compromise of real-world websites.

Amazon Threat Intelligence identified an exploitation attempt in its MadPot telemetry dating to October 17, 2026. The flaws were publicly announced on October 20, and patches were released the following day. CISA separately said it had not observed exploitation as of October 21.

These reports describe different observations and should not be treated as proof of widespread successful compromise. An attempt recorded by a honeypot or threat-intelligence system does not show that an attacker broke into a live service or accessed its data. Operators should treat public exploit activity as a reason to verify defenses, not as evidence that every affected site has already been breached.

Which PHP Versions Need an Urgent Patch?

The PHP project’s patched releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Operators should install the fixed release for their branch or apply their operating-system vendor’s updated package. The project released these versions on October 21, 2026.

The CERT-EU security advisory urges prompt patching and recommends isolating internet-facing applications if updates cannot be applied quickly. The exact update path depends on whether PHP comes from the project, an operating-system package, or a hosting provider.

Patched branches and exact update numbers

The four fixed PHP versions are:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

PHP 8.2 remains in security support through December 31, 2026. PHP 8.3 receives security support through December 31, 2027. For PHP 8.4, active support runs through December 31, 2026, with security support through December 31, 2028.

PHP 8.5 receives active support through December 31, 2027, and security support through December 31, 2029. Each PHP release branch has two years of active support, followed by two years limited to critical security fixes. After four years, the branch reaches end of life.

Older branches and vendor-specific fixes

WatchTowr reports that the flaws affect every PHP version from PHP 5 onward, but says that scope was not confirmed by an official vendor advisory. Patches were not available for PHP 5. Source-code patches were released for PHP 7.4, 8.0, and 8.1, but the project released no official updated binaries for those end-of-life branches.

That distinction matters for the question, “Is PHP 7.4 vulnerable?” Yes. PHP 7.4 is affected, but source patches are not the same as an official updated binary ready for installation. Some providers can build and distribute their own packages for older branches.

Clever Cloud made PHP 7.4.33, 8.0.30, and 8.1.34 builds available on its service on October 21, 2026, with fixes for both CVEs. Those builds fix only the two PHP2Shell flaws; they do not remove other vulnerabilities in PHP 8.1 and earlier.

Limited updates had also been made available for PHP 7.4, 8.0, and 8.1. PHP 8.2 reaches end of life on December 31, 2026, despite its security support continuing through that date. Check the exact runtime and package source before assuming an older branch has received a complete security update.

What Should Website Owners Do Now?

The first task for a website operator is to find every PHP runtime, including those inside containers and managed deployments. Installing a fixed runtime is the main remedy; a web application firewall (WAF) or network restriction is only a temporary layer.

A WordPress core, theme, or plugin update does not patch PHP itself. The application and its runtime are separate parts of the system, so operators need to check the version serving each public-facing site.

1. Inventory PHP across servers, containers, and other deployments.
2. Apply the fixed release or the updated package supplied by the operating-system vendor.
3. Rebuild and redeploy custom images and applications so they use the patched runtime.
4. Ask managed-hosting providers whether they have updated the PHP runtime.
5. Review logs for unusual multipart requests, memory-limit errors, repeated HTTP 500 responses, oversized PHPSESSID cookies, and unexplained worker churn.

After a rebuild, operators should confirm that running containers and services actually use the new image. An updated image sitting in a registry does not protect a live system until the deployment changes.

A WAF rule or request-size limit may reduce exposure while a patch is pending, but neither replaces a fixed PHP version. If an internet-facing system cannot be patched or protected promptly, operators should consider restricting access or taking it offline, consistent with urgent agency guidance.

Home Assistant core is Python-based, so PHP2Shell does not affect a Home Assistant installation merely because it runs Home Assistant. A separately installed PHP service, such as phpMyAdmin, can create a distinct exposure on the same infrastructure.

For Palo Alto Networks products, the affected PAN-OS component is the management web interface, including the HTTPS web UI and XML API service. GlobalProtect portal and gateway are not affected, and no special configuration is required for the products to be affected.

Palo Alto Networks rates the impact at CVSS-B 8.7 under CVSS 4.0 and says risk is highest when the management interface is open to external internet IP addresses. Restricting management access to trusted internal IPs is recommended; access limited to a jump box can reduce the score to 7.1.

The company said it was not aware of malicious exploitation against its products when its advisory was published. If a provider manages the site, ask for the running PHP version and written confirmation that the patched runtime has been deployed.

Conclusion

The safest next step is to confirm which PHP version is actually running each public-facing service. The runtime version matters more than whether the visible application was just updated.

Check the server package, container image, or hosting-provider runtime. If patching is delayed, use temporary protections to reduce exposure, and restrict access to systems that cannot be secured promptly.

Ask the administrator or hosting provider to confirm the patch and redeployment before treating the service as secure.