# php2shell (CVE-2026-109618 / CVE-2026-109619)

By PHP Patch Assurance · Last updated: 2026-10-25

php2shell is the name given to two critical flaws in PHP core,
CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), disclosed on
October 21, 2026. They allow unauthenticated remote code execution:
anyone on the internet can run code on an affected server, with no
password and no login. Fixed PHP releases shipped the same day.

## Who is affected?

Any site running PHP below the fixed releases.

| PHP branch | Vulnerable | Fixed release |
| --- | --- | --- |
| 8.5 | below 8.5.12 | 8.5.12 |
| 8.4 | below 8.4.27 | 8.4.27 |
| 8.3 | below 8.3.36 | 8.3.36 |
| 8.2 | below 8.2.35 | 8.2.35 |
| Below 8.2 | all versions | none — end-of-life, upgrade required |

## How to check and patch

1. Run the free scan at https://phpatch.com/scan
2. If the version is hidden, the scan says INDETERMINATE — run the
   read-only deep check after proving ownership.
3. If vulnerable, order the patch at https://phpatch.com/patch:
   snapshot and restore-test first, patch, live verification, work
   report; failed health checks revert automatically.
4. If your PHP is below 8.2, upgrade the branch (one-click for
   Docker hosts) or take the site offline until it can be upgraded.

## Timeline

- October 20, 2026 — details leak; PHP announces emergency releases
  (19:33 UTC); CERT-EU advisory 2026-018 first issued.
- October 21, 2026, 08:55 EDT (21:55 JST) — Japan's prime minister
  Sanae Takaichi posts urging action that night.
- October 21, 2026, 09:30 EDT (13:30 UTC) — PHP emergency releases
  ship: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
- October 21, 2026 — CISA, UK NCSC and NSA Cyber alerts; early
  attacks confirmed; services in the Netherlands and Japan into
  emergency maintenance or offline.
- October 22, 2026 — JPCERT/CC advisory JPCERT-AT-2026-0033 and IPA
  advisories publish.

## Primary sources

- PHP: https://www.php.net/
- CISA: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- CERT-EU advisory 2026-018
- JPCERT/CC JPCERT-AT-2026-0033: https://www.jpcert.or.jp/
- IPA, UK NCSC, NSA Cyber alerts of October 21-22, 2026