What happened?
On 20 October 2026, the PHP project announced a critical security update, with the patches following on the afternoon of 21 October. Details of the vulnerabilities had already surfaced online prior to the coordinated release. The German Federal Office for Information Security (BSI) has issued a cyber security warning, and CERT-EU, the IT emergency response team for the EU institutions, has also issued an urgent warning.
The two vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. Both have a CVSS score of 9.2 out of 10. In the specialist press, they are referred to as “PHP2Shell”, in reference to the notorious Log4Shell vulnerability from 2021.
Product affected | PHP |
Affected versions | all versions prior to 8.5.12, 8.4.27, 8.3.36 and 8.2.35; according to security researchers, the vulnerability affects versions as far back as PHP 5.4 |
Severity | CVSS 9.2 out of 10 (critical), BSI alert level 3 / Orange |
Patch versions | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Consequences | Remote code execution without authentication |
Why these vulnerabilities are so dangerous
Attackers can exploit these vulnerabilities to remotely execute malicious code on web servers running PHP applications. They do not need any login credentials or user interaction to do so.
Technically, the vulnerabilities affect PHP’s internal memory management:
CVE-2026-109618: If PHP is forced into an out-of-memory situation during a request, the subsequent clean-up process may treat partially initialised data as valid.
CVE-2026-109619: Request-related states may persist even though their memory has already been released. A subsequent request in the same worker then accesses this stale data.
For Apache with mod_php, the PHP project has confirmed an attack that works without authentication and occurs before any application code is even executed. Consequently, even a carefully developed application cannot prevent the attack.
The BSI anticipates rapid exploitation. BSI Vice-President Thomas Caspers considers widespread exploitation likely within a few hours of the security updates being released. The reason: AI-powered tools now make it possible to analyse patches very quickly and translate them into working exploits.
This assessment is already being borne out. The security firm watchTowr has been observing active attack attempts targeting both vulnerabilities since 21 October. Amazon Threat Intelligence even reported the first attack attempts on its own honeypots as early as 17 October – four days before the disclosure. According to CERT-EU, the first proof-of-concept exploits are also circulating. It is currently unclear how many systems have already been successfully compromised.
Who is affected?
In short: virtually anyone who uses PHP on the web. PHP is one of the cornerstones of the internet. It underpins platforms such as Shopware, Magento, WordPress, TYPO3, Drupal, Joomla and Nextcloud, as well as numerous proprietary products and firewall systems such as pfSense and OPNsense.
All PHP installations that process web requests are affected, for example via PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. According to the PHP project, the risk is highest with mod_php.
The situation is particularly critical for systems running outdated PHP versions. All versions prior to PHP 8.2 have already reached their end-of-life and no longer receive regular security updates. For PHP 7.4, 8.0 and 8.1, the PHP security team only provides minimal fixes to the source code, but no finished releases. For even older versions, there are no fixes at all. PHP 8.2 will only be supported until 31 December 2026.
What to do now
The only way to ensure complete protection is to update to a patched version of PHP. We therefore recommend that operators of PHP applications take the following steps:
Older PHP versions: elio has solutions ready for you
Not every system can be upgraded to the latest PHP version at short notice. Established online shops, bespoke developments or interfaces to ERP and PIM systems are often tied to a specific version. A migration then takes time, and attackers won’t give you that time.
We also have solutions ready for you for PHP versions older than 8.2. The right approach depends, amongst other things, on your application and your hosting. We’ll clarify this with you in a personal consultation.
This ensures your existing system remains protected whilst you plan the migration to a current PHP version at your own pace.
Important: Securing older PHP versions involves a case-by-case assessment and requires an appropriate budget. We’d be happy to discuss with you which approach makes the most economic sense for your system: securing the existing version, migrating, or a combination of both.
Additional protection provided by a web application firewall
A Web Application Firewall (WAF) checks incoming requests before they reach the application and can specifically block attack patterns, provided that suitable detection rules for the vulnerabilities are in place. It does not replace the update, but provides a valuable additional layer of protection.
On request, elio can deploy a WAF in front of your application. This is particularly helpful in situations such as this:
Protection during the critical phase between a vulnerability being disclosed and the patch being applied
Additional protection for systems running older versions of PHP
Defence against further attacks such as SQL injection, cross-site scripting or automated bot attacks
Here too, the scope and configuration of the WAF are tailored to your requirements and budget.
Conclusion: Take action now, even for older systems
The PHP2Shell vulnerabilities are among the most critical security flaws of recent years. They affect almost every PHP installation and can be exploited remotely without the need for authentication. The first attempts at attack are already underway. System administrators should apply the patches immediately and monitor their systems closely.
Those who rely on older PHP versions are not left defenceless. elio also offers solutions for established systems – supplemented, on request, by an upstream WAF – thereby creating the scope for an orderly migration.
Would you like to secure your PHP systems?
Whether it’s a patch check, securing older PHP versions, a web application firewall or migrating to the latest PHP version: we’ll assess your systems and show you which approach best suits your requirements and budget.
Sources
BSI: Cybersecurity alert ‘PHP: Critical vulnerabilities threaten web applications worldwide’, version 1.1 dated 21 October 2026, https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.html
PHP: News Archive 2026, Critical PHP Security Release, https://www.php.net/archive/2026.php
CERT-EU: Security Advisory 2026-018 “Critical Vulnerabilities in PHP”, https://cert.europa.eu/publications/security-advisories/2026-018/
http://ingenieur.de: “Critical PHP vulnerabilities: BSI warns of attacks on web servers” (21 October 2026), https://www.ingenieur.de/kritische-php-luecken-bsi-warnt-vor-angriffen-auf-webserver-e0529b4b-15c8-444a-974a-00919edb30b6/
watchTowr: “PHP Remote Code Execution (PHP2Shell)”, https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
Tenable: “php2shell (CVE-2026-109618, CVE-2026-109619): FAQ”, https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
