Vulnerabilities
PHP releases emergency patches for two critical flaws affecting websites and online shops
PHP, the language behind WordPress and many websites and online shops, released patches on 21 October for two critical flaws that may allow an attacker to take over the server without a password. Details leaked early and there are already reports of attack attempts. If you have a website, ask your provider.
PHP — Affected software project (web programming language)
In 30 seconds
- On 21 October PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical flaws (CVE-2026-109618 and CVE-2026-109619, scored 9.2 out of 10) that may allow code to be run on the server without credentials.
- According to PHP, "all PHP installations serving web requests" are at risk, and updating is the only complete fix.
- Details leaked on 20 October, before the patch. watchTowr and Cloudflare report attack attempts; as of 21 October there were no confirmed intrusions.
- PHP 8.1 and older no longer receive official updates: websites running them need to migrate.
Does this affect me?
It affects you if your company has a website, online shop, intranet or business application running on PHP, which is very common: WordPress, Drupal, Joomla and Magento all use it. Updating usually depends on your hosting provider or the agency that maintains the site. It does not affect you if your website doesn't use PHP. No Spanish victims have been confirmed.
What happened
On 21 October 2026, the PHP security team published an advisory titled "Critical remote code execution vulnerabilities, update now". PHP is the language that WordPress, Drupal, Joomla and Magento run on.
The new versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell". According to PHP, both "can allow unauthenticated remote code execution": an attacker could run their own commands on the web server without needing a username or password. The project urges "all PHP users" to update "immediately".
On 20 October, PHP had announced the patches for the following day. According to Huntress and The Hacker News, information about the flaws leaked that same day, before a fix was available.
What we know
- What is at risk (according to PHP): all PHP installations serving web requests, including the most common server and hosting setups (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed). PHP considers the risk highest with mod_php.
- Severity: PHP scores both flaws 9.2 out of 10 (CVSS v4.0) and rates them critical.
- Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions received the patches in advance, so providers may already have updated packages.
- Older versions: PHP 8.1 and older no longer receive updates from the project. PHP 8.2 reaches end of life on 31 December 2026.
- Temporary measures: PHP publishes configuration settings that reduce exposure, but warns that they "do not make an installation safe": "updating is the only safe choice".
What we don't know yet
- Whether websites have already been compromised. According to The Hacker News, watchTowr reported "active exploitation attempts" of both flaws on 21 October, and Cloudflare reported "early attacks emerging". Huntress, on the other hand, had not observed exploitation on the systems it monitors as of 4:30pm (US Eastern time) that day. No source has confirmed a successful intrusion, and the flaws were not yet in CISA's catalogue of exploited vulnerabilities.
- Whether there are victims in Spain. None have been confirmed.
Why it matters
The flaw is not in a plugin or a specific website, but in PHP itself. That means a well-built website with all its plugins up to date can still be exposed if the server's PHP hasn't been updated.
On top of that, the leak has shortened the usual gap between the patch and the first attacks. When details circulate before the fix, reaction time is measured in days.
What it means for an SME
In a small company, the website is hardly ever managed in-house: it usually sits on shared hosting or on a server an agency set up years ago. It is common for nobody in the company to know which PHP version it runs.
A compromised website is not just a reputational problem: it may hold the shop's customer data, contact forms or access to an intranet. And if personal data is affected, there may be an obligation to notify the AEPD, Spain's data protection authority.
What your company should do this week
- Take inventory: corporate website, online shop, intranet, customer area, business applications with web access. Write down who maintains each one.
- Ask your hosting provider or agency whether they use PHP and whether it is already on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or on a version patched by their Linux vendor). Ask for the answer in writing.
- If you are on PHP 8.1 or older, there is no official fixed version: ask for a migration plan with a date. In the meantime, have them apply the temporary measures PHP publishes.
- Ask them to check for signs of intrusion since 20 October, especially if the update is delayed.
- Check that there is a recent backup of the website and that it can be restored.
If you're not sure which of your company's services are exposed to the internet or who updates them, that's exactly what a cybersecurity audit reviews.
Sources
- PHP — «Security advisory: Critical remote code execution vulnerabilities, update now» (21 October 2026)Primary source
- PHP on GitHub — advisory GHSA-w8hw-w9fx-j79w, «RCE via OOM corruption» (CVE-2026-109618, 21 October 2026)Primary source
- PHP on GitHub — advisory GHSA-6wmf-4rv5-p3rp, «RCE via stale global state» (CVE-2026-109619, 21 October 2026)Primary source
- Huntress — «Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)» (20 October 2026, updated on the 21st)
- The Hacker News — «PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge» (21 October 2026)
Defentria editorial team. The Defentria team selects cybersecurity news from primary sources (CERTs, official bodies and vendors) and explains what it means for a Spanish SME and what to do about it.
