# PHP2Shell: What the Critical PHP RCE Flaws Mean for Your Servers
Two critical vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and informally dubbed PHP2Shell, were fixed in the emergency PHP security release of 21 October 2026 [2]. Both allow unauthenticated remote code execution from a simple crafted request, before any application code runs, which is why PHP rated them CVSS v4.0 9.2 and described updating as the only safe choice [2]. The Dutch National Cyber Security Centre considers large-scale exploitation likely in the short term and maintains a public operational repository for responders [1]. This post covers what is affected, what to do first, and what exploitation should look for in your logs.
What Happened
The two flaws leaked before coordinated disclosure on 20 October 2026, PHP announced a same-day emergency release for 14:00 UTC on 21 October, and the fixed versions landed as 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [4]. The PHP team's release notice is blunt: these are critical vulnerabilities that can allow unauthenticated remote code execution, and there are no complete mitigations [2]. Vulnerable versions span all releases from PHP 5.4 through 8.5.11; the PHP project is not fixing 8.1 or earlier, which have reached end of life [3].
Because the flaws sit in the PHP runtime itself rather than in any application, every PHP-powered web property is potentially affected, including content management systems, hosting control panels and appliances that ship their own PHP [3]. The NCSC-NL repository publishes alphabetized inventory lists of downstream software with a PHP dependency so operators can check their stack product by product [1].
What to Do First
The response order is straightforward:
- Patch supported branches to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately. On distribution-managed PHP, check your vendor for backported packages; LTS vendors received the patches in advance [4].
- Inventory every PHP runtime you run, including containers, control panels and appliances with embedded PHP, not just the version the command line reports [3].
- If a system cannot be patched right away, the advisory lists settings that reduce exposure to specific attack paths, but these are partial measures, not fixes [4].
- PHP 8.1 and older have no upstream fix. Move those workloads to a supported branch or rely on a distribution that backports the fix [3].
What Exploitation Looks Like and How to Detect It
The practical detection signal is behavioral: a web server or PHP-FPM process doing something it should never do. Huntress frames the post-exploitation chain clearly: spawn a shell or interpreter, pull a payload from the network, and drop a webshell into the web root [5].
On Linux servers without endpoint detection, Huntress points to Florian Roth's process-watcher, a free process monitoring tool that can run in observe mode to baseline normal PHP behavior before anything anomalous shows up [5].
New files in the web root deserve special attention. A web server writing fresh PHP or script content into the document root is abnormal outside a deployment window, and double-extension uploads or polyglot files are classic webshell camouflage [5]. If you find signs of compromise, isolate the server and preserve web server and PHP logs, then hunt for webshells, new cron jobs, scheduled tasks and unexpected accounts [5].
The NCSC-NL Repository Is the Operational Hub
The Dutch National Cyber Security Centre's php2shell repository is the most useful public artifact for responders, and it is actively maintained as the situation develops [1]. It contains the downstream software inventory, detection and mitigation material including a cPanel EasyApache 4 mitigation script, and tooling to regenerate the inventory lists, all published TLP:CLEAR under the EUPL license [1]. Star it rather than forking it: the repository is still expanding, and the canonical copy stays current.
The Bottom Line
PHP2Shell is the rare vulnerability class where the guidance is genuinely simple: patch every PHP runtime you own to a fixed release, inventory the ones you forgot about, and put process and webroot monitoring in place today rather than after the first wave of exploitation. The vulnerabilities were leaked before the fix existed, public proof-of-concept code is already circulating, and national CERTs expect mass exploitation [1][5]. The window between patch availability and attacker adoption is days, not weeks.