PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline

PHP issued emergency updates for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, which can allow unauthenticated attackers to execute code or disclose sensitive data on affected web servers. The flaws, rated 9.2 CVSS, affect web-facing PHP deployments including Apache mod_php, PHP-FPM, CGI, FrankenPHP, and LiteSpeed, with particularly serious risks because attacks may occur before application code or authentication controls run. NSA and CERT-EU advised organizations unable to patch immediately to take exposed systems offline or isolate them, while Cloudflare reported observing attack attempts and provided temporary WAF protections. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while limited source backports are available for some unsupported releases. The incident is complicated by the large share of websites using end-of-life PHP versions—estimated at roughly 48.5%—where compatibility issues can slow upgrades, although some systems may receive vendor backports. Administrators must update the PHP runtime itself, restart relevant services and workers, and verify managed providers have patched, as updating WordPress, plugins, or application frameworks alone does not resolve the vulnerabilities.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.