Skip to contentistheinternetok
All incidents

Security flaw·Critical

PHP2Shell: two critical flaws in PHP

Fix availableAttackers already use itAffects website owners
PHP

What it changes for you

Some government websites went offline as a precaution.

PHP, the language behind a large share of websites, fixed two flaws that let an attacker take over a web server with a single request. Several governments took websites offline as a precaution; visitors have nothing to do, site owners must update PHP now.

Started Oct 20, 2026Updated Oct 23, 2026

Post on X

What should I do?

You
Nothing to do. Some government websites may be offline for a while.
If you run a website or an app
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package; check its changelog for the CVE ids) and restart every worker. PHP 8.1 and older get no official fix. Mitigations such as session.upload_progress.enabled=0 only reduce exposure; updating is the only complete fix.

What is affected

CVE-2026-109618CVE-2026-109619Severity score 9.2 out of 10

Timeline

  1. Fix available · Oct 23, 2026

    Cloudflare extends its rules to a related PHP session upload progress issue, CVE-2026-115560.

    Cloudflare

  2. Fix available · Oct 21, 2026

    Government websites in several countries, including Germany, Finland, Belgium, the Netherlands and France, are taken offline as a precaution.

    Australian Associated Press

  3. Fix available · Oct 21, 2026

    PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing CVE-2026-109618 and CVE-2026-109619. All PHP installs serving web requests are affected; risk is highest with Apache mod_php.

    php.net

  4. Mitigated · Oct 21, 2026

    Cloudflare enables WAF rules against the flaws on all plans, including Free, from 03:02 UTC, and reports attack traffic targeting its customers after details leaked.

    Cloudflare

  5. Identified · Oct 20, 2026

    PHP announces a critical security release for October 21 fixing two vulnerabilities rated CVSS v4.0 9.2.

    php.net

Sources

Related