Cyber One Solutions logo.
Get Support

Security Advisory

Patch PHP Immediately: Two Critical, Unauthenticated RCE Flaws Affect Every PHP Website

October 21, 2026 · Cyber One Solutions Security Team

PHP released emergency fixes on October 21, 2026 for two critical flaws, nicknamed "php2shell," that can let an attacker run code on any PHP web server without logging in. Attack traffic was observed before many servers could update. Here is who is affected, what cPanel servers need, and what to check now.

On October 21, 2026, the PHP project released emergency updates for two critical flaws in PHP itself, the server-side programming language behind the large majority of small-business websites, including WordPress and most other common content-management and e-commerce platforms. PHP's own security announcement says the flaws "can allow unauthenticated remote code execution," that "all PHP installations serving web requests" are at risk, and that "all PHP users are strongly encouraged to update immediately." The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated Critical with a CVSS v4 score of 9.2, and the Cybersecurity and Infrastructure Security Agency (CISA) published its own alert the same day, nicknaming the pair "php2shell".

This is not only theoretical. Details leaked before the planned release date, and Cloudflare reports that it "observed attack traffic targeting our customers" and saw attackers "mutating the attack payload to try to bypass our protections." CISA's alert said it had not observed exploitation as of its publication, and the flaws were not in CISA's Known Exploited Vulnerabilities catalog as of October 21, so treat this as a fast-moving situation with real attack attempts already under way, not one where there is time to wait.

What the Two Flaws Actually Are

Both flaws come from PHP cleaning up incorrectly after a request fails partway through. In the first, CVE-2026-109618 ("RCE via OOM corruption"), the PHP project explains that out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and the cleanup step may then treat that invalid data as valid. In the second, CVE-2026-109619 ("RCE via stale global state"), internal state that belongs to one request can survive after its memory has been freed, and a later request handled by the same server worker may use it before it is reset. Either way, the result can be memory corruption that a crafted request turns into running the attacker's own code with the permissions of the web server's worker account. The technical detail is in the two official advisories, GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

Why This Is Serious

"Remote code execution" means an attacker can get the server to run commands of their choosing; "unauthenticated" means they need no password, account, or user click, just the ability to send the site a web request, which on a public website is anyone. The PHP project names every common way of running PHP on a web server as affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It considers the risk highest for mod_php, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," which means a login page, a security plugin, or other protection inside the website itself cannot stop it. The CVSS scoring does mark both flaws as high in attack complexity, so not every attempt will succeed, but with working exploit techniques demonstrated and attack traffic already observed, the safe assumption is that unpatched, internet-facing PHP sites are being probed now.

Who This Affects

If your business has a website, there is a good chance it runs on PHP somewhere: self-hosted WordPress, another PHP-based CMS, a client portal or billing system, a custom application your developer built, or an e-commerce platform. CISA's alert also warns that PHP is often bundled inside other software that does not advertise itself as PHP, so an inventory needs to look past the obvious candidates. If Cyber One Solutions hosts and maintains your website through our website design, hosting, and maintenance service, server-side patching for an issue like this is part of that engagement rather than something you need to track yourself. If your site is hosted or maintained elsewhere, ask whoever manages it directly what PHP version it runs and whether the update has been applied.

If Your Site Runs on cPanel and WHM

cPanel servers need two separate updates, and one does not cover the other. cPanel's October 21 release notes list both:

Updating cPanel itself does not update the PHP versions your sites use, and updating EasyApache does not update cPanel's own internal PHP, so confirm both.

What to Do Now

Why This Belongs on Your Radar

A critical, unauthenticated flaw in the language running most small-business websites, with attack attempts observed on day one, is exactly the kind of issue that turns an outdated, unwatched website into an entry point. The response is straightforward: find out which PHP version each of your sites runs, confirm the update has been applied, including both cPanel updates where they apply, and keep a dated record that you checked.

Cyber One Solutions manages hosting, updates, and security monitoring for client websites through our website design, hosting, and maintenance service, including applying server-side updates like this one. If you manage your own site, or inherited one from a previous developer and are not sure who last touched it, our IT and security assessments can confirm what is actually running and what needs attention first; our coverage of why small business websites get hacked covers the related, more common risk of outdated plugins and themes on a site nobody is actively maintaining.

Sources