PHP has released security updates for two critical vulnerabilities that could allow an unauthenticated attacker to execute code on a web server. Updating is the only complete fix.
The vulnerabilities, nicknamed php2shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 — Critical — under CVSS v4.0.
An attacker could exploit either vulnerability by sending specially crafted HTTP requests. Successful exploitation could allow code execution with the privileges of the account running PHP, without logging in.
PHP is used by roughly 7 in 10 websites, including ours. The vulnerabilities are reported to have been present since 2012. As AI capabilities make vulnerability discovery cheaper, prompt patching is increasingly important.
Install one of the following patched PHP versions immediately:
The risk applies to PHP installations serving web requests, including:
mod_phpphp-cgiThe risk is considered highest for mod_php: a demonstrated exploit can trigger the attack before application code runs.
AlmaLinux 8, 9, and 10 ship affected PHP versions. Check your distribution’s security advisories and install its patched packages.
PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and long-term support vendors may provide backported fixes. Contact your vendor to confirm whether your installed version is patched, or upgrade to a supported PHP release.
There are no complete mitigations. Interim measures may reduce exposure to specific attack paths, but they do not make an affected installation safe. Prioritize updating as soon as possible.
Thanks to the researchers who found and reported these flaws (credited in PHP advisories), to Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka, and Nora Dossche for developing the fixes, and to the PHP security team for coordinating the release.
