On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities collectively known as PHP2Shell.
Both vulnerabilities carry a severity score of 9.2 out of 10 and could allow attackers to execute malicious code on vulnerable servers without authentication.
This should concern more than PHP developers. It should concern governments, financial institutions, hosting companies, businesses, and every organization that depends on the web.
PHP Powers a Significant Part of the Internet
According to W3Techs, PHP powers approximately 69% of websites whose server-side programming language can be identified.
PHP supports WordPress, Drupal, Joomla, Laravel, Symfony, Magento, and countless custom applications.
Government portals, educational institutions, hospitals, financial platforms, e-commerce businesses, and public services depend on PHP-based infrastructure.
When vulnerabilities affect PHP itself, the implications extend far beyond individual websites.
Protecting PHP means protecting a substantial part of the internet.
What Is PHP2Shell?
PHP2Shell refers to two vulnerabilities discovered in PHP's core runtime:
CVE-2026-109618: A memory corruption vulnerability involving out-of-memory handling.
CVE-2026-109619: A vulnerability involving stale internal state that can lead to use-after-free conditions.
Under exploitable conditions, attackers may execute unauthorized code or expose sensitive information.
These vulnerabilities affect the PHP runtime, not simply application code.
Therefore, updating WordPress, Laravel, or another PHP application does not replace the need to patch PHP itself.
Which PHP Versions Are Affected?
The PHP project released the following fixed versions on October 21, 2026:
| PHP branch | Affected versions | Fixed version |
|---|---|---|
| PHP 8.5 | 8.5.11 and earlier | 8.5.12 |
| PHP 8.4 | 8.4.26 and earlier | 8.4.27 |
| PHP 8.3 | 8.3.35 and earlier | 8.3.36 |
| PHP 8.2 | 8.2.34 and earlier | 8.2.35 |
| PHP 8.1 | End-of-life | Vendor/source backport or upgrade |
| PHP 8.0 | End-of-life | Vendor/source backport or upgrade |
| PHP 7.4 | End-of-life | Vendor/source backport or upgrade |
Older PHP branches may also be affected. PHP 8.1 and earlier no longer receive normal upstream security releases.
PHP 8.2 reaches end-of-life on December 31, 2026, making migration to newer supported branches increasingly important.
How Organizations Should Respond
Every organization operating PHP applications should immediately:
Identify every PHP installation. Run
php -v, but remember that the command-line PHP version may differ from the version serving websites.Apply the appropriate security update. Install patched PHP packages from your operating-system, hosting, or PHP distribution vendor.
Test compatibility. Check extensions, Composer dependencies, frameworks, and critical application workflows before production rollout.
Restart PHP services. Restart affected PHP-FPM workers, Apache, or other PHP runtimes to ensure patched binaries are running.
Verify and monitor. Confirm the web-facing runtime uses the patched build and examine logs for suspicious activity.
On Ubuntu, administrators can update available security packages using:
sudo apt update && sudo apt upgrade
However, the commands alone do not guarantee a fix. Confirm that your distribution actually supplies the patched PHP package.
What About Organizations Still Running PHP 7.4?
PHP 7.4 reached end-of-life in November 2022.
There is no new official PHP 7.4 security release. However, the PHP security team published minimal source backports for PHP2Shell, and some vendors provide patched builds.
For example:
Ubuntu 20.04 has a PHP 7.4 fix through Ubuntu Pro Extended Security Maintenance.
Plesk provides a rebuilt PHP 7.4.33 package containing the fix.
An existing PHP 7.4.33 installation is not automatically protected. The vendor's package build and security advisory must be verified.
Organizations unable to migrate immediately should obtain a verified vendor-maintained security backport, restrict exposure, and establish a funded migration plan.
Firewalls and temporary mitigations can reduce risk but cannot replace patching.
The Bigger Problem: Open-Source Sustainability
PHP2Shell exposes another uncomfortable reality.
Much of the internet depends on open-source infrastructure maintained by relatively small engineering teams.
The PHP Foundation acknowledged that signs of one underlying vulnerability appeared in 2024, but difficult technical decisions, limited specialist resources, and problems in its decision-making process delayed resolution.
That should be a wake-up call.
Organizations earn revenue, deliver public services, and operate critical systems using PHP, yet the language's maintenance and security work cannot be taken for granted.
Open source is free to use. It is not free to maintain.
A Call for More Funding
Governments, banks, hosting providers, cloud companies, technology businesses, and large PHP users should contribute directly to the projects they depend on.
We need sustained investment in security audits, experienced maintainers, vulnerability research, testing infrastructure, and the next generation of PHP core developers.
The PHP Foundation provides a direct way to support this work:
https://thephp.foundation/donate/
Supporting PHP should not be treated merely as charity.
It is an investment in the security, reliability, and future of the web.
PHP has helped build the internet for more than three decades. Its continued protection and improvement deserve serious, long-term financial commitment.
Patch your PHP installations today. Fund the people who protect them tomorrow.
No comments:
Post a Comment