Cybertix Logo
Cybertix updates
← Back to News
ALERT · CYBERSECURITY

PHP2Shell alert: critical PHP vulnerability — what it is and how to protect your website today

On 21 October 2026, the PHP team released an emergency update fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell (CVSS v4.0: 9.2). They allow code to be executed remotely on the server, apparently without a password, and exploitation attempts have already been observed. They affect any website or application running on PHP (WordPress, Drupal, Joomla, Magento, Laravel, Moodle or custom intranets). The solution is to update PHP to a patched version: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

Threat level: CRITICAL. Active exploitation reported · Remote code execution · Act within hours, not days.

For non-technical readers: what you need to know and do today

In 30 seconds

What is happening
There is a serious flaw in PHP, the language used to build millions of websites. An attacker could take control of the server hosting your website.
Who is affected
Your business, if you have a corporate website, online shop, intranet or portal built with PHP. If you use WordPress, it runs on PHP.
What needs to be done
Ask whoever manages your website or hosting to update PHP today. Updating WordPress or its plugins does not fix this flaw: PHP must be updated on the server.

Am I affected? Check in two minutes

  • Does your business have a website, online shop, intranet, extranet, learning platform or management software accessible from the internet?
  • Is it managed by a supplier, agency or hosting provider? They need to take action, and you need to ask them for confirmation.
  • Do you use WordPress? In the dashboard, go to Tools → Site Health → Info → Server to see the PHP version.

Five simple steps

  1. List all your business websites and online applications, and who manages each one.
  2. Contact your supplier or hosting provider today and ask for written confirmation.
  3. Ask for a recent backup before they update, and ask them to check that it works.
  4. If your PHP version is old (8.1 or earlier), there is no official patch. You need to migrate urgently. In the meantime, isolate that server or protect it with additional measures.
  5. Watch for unusual signs on your website (unfamiliar pages, unexpected redirects, unusual slowness or hosting alerts). If you see any, do not wait: let us know.

How Cybertix can help

You do not need to understand all of this to stay protected: that is what we are here for. We can help you today with:

  • A quick inventory of exposed PHP assets and the versions they are actually running.
  • Planning and verifying patching on servers, control panels and containers.
  • Temporary containment (WAF, access restrictions) for systems that cannot be patched.
  • Compromise assessment and incident response, including forensic analysis, if you detect suspicious activity.
  • Continuous monitoring with the All-in-One 24×7 SOC, so the next alert does not catch you off guard.
Urgent contact

Every alert of this kind teaches the same lesson: know what you have, be able to update it quickly, avoid unsupported software, keep working backups and have a response plan. These are the cybersecurity foundations we help build, so you can keep focusing on your business without worries or disruption. And if you develop your own applications, security by design reduces the impact of flaws like this.

Frequently asked questions

What is PHP2Shell?

It is the name given to two critical vulnerabilities in the PHP language itself, CVE-2026-109618 and CVE-2026-109619, which allow remote code execution on the server. They have a CVSS v4.0 score of 9.2, and a fix was released on 21 October 2026.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Versions 8.1 and earlier do not receive an official patch.

Is my WordPress website affected?

Yes, if it runs on an unpatched PHP version. Updating WordPress or its plugins does not fix the flaw: PHP must be updated on the server. Your hosting provider or supplier can do this, and you should ask for written confirmation.

How do I find out which PHP version I use?

In WordPress: Tools → Site Health → Info → Server. Otherwise, your hosting provider or technical team can tell you. Do not publish a phpinfo() file to check.

Can I protect myself without updating?

Only temporarily: use a WAF with updated rules, restrict access through a VPN or take the system offline. According to the PHP team, configuration changes do not resolve the flaw. The permanent solution is the patch.

What should I do if I use PHP 7 or 8.1?

There is no official patch. You need to migrate to a supported version or arrange extended support that confirms the fix. Meanwhile, isolate the server or protect it with a VPN and WAF.

How do I know if I have already been attacked?

Look for new or modified PHP files, unusual processes and connections, and repeated PHP crashes. If you are unsure, contact us: patching does not remove an existing intrusion.

Do I need to report it?

If there is a personal data breach, the GDPR requires notification to the data protection authority within 72 hours of becoming aware of it. NIS2 and Spain’s National Security Framework (ENS) may impose additional obligations depending on your circumstances.