Two serious bugs in PHP can let attackers take over your website without logging in. Here is what happened, who is at risk, and exactly what you should do right away.
If your website runs on PHP, this is important news for you.
On 21 October 2026, the PHP team released urgent security updates for two critical problems. Security researchers call them PHP2Shell. The official names are CVE-2026-109618 and CVE-2026-109619.
Both bugs can let someone who has never logged into your site run their own code on your server. That is as bad as it sounds.
What Exactly Went Wrong?
PHP is the language that powers a huge part of the web, including WordPress, many online shops, and countless custom websites.
The two bugs are related to how PHP handles memory when something goes wrong during a request.
CVE-2026-109618 happens when PHP runs out of memory at a bad moment. It leaves some internal data half-finished. Later cleanup steps treat that incomplete data as if it were ready. Clever attackers can force this situation and take control.
CVE-2026-109619 is a bit different. PHP keeps some global information that points to memory belonging to one request. Sometimes that information is not cleaned up properly. The next request handled by the same worker process can use the old, already-freed memory. That also opens the door to running attacker code.
Both are rated 9.2 out of 10 on the newest CVSS scale. They need no login and no special user action.
Who Is Affected?
Almost every PHP installation that serves web pages is at risk if it is not patched:
Apache with mod_php (highest risk)
PHP-FPM
php-cgi
FrankenPHP
LiteSpeed
The affected versions are:
PHP 8.2 before 8.2.35
PHP 8.3 before 8.3.36
PHP 8.4 before 8.4.27
PHP 8.5 before 8.5.12
Older versions (8.1 and below) are also affected, but they no longer receive official updates. If you are still on those, you need a plan to upgrade.
Reports already show that attackers have started trying these bugs in the wild.
What You Should Do Right Now
The only complete fix is to update PHP.
Update to one of these safe versions: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
Restart every PHP worker or service after the update so the new code is actually running.
If you get PHP from a Linux distribution or hosting provider, check their security advisories. Many already shipped the patches.
If you cannot update immediately, some temporary settings can reduce risk, but they are not perfect:
Turn off session upload progress: session.upload_progress.enabled = 0
On PHP 8.5, also set fatal_error_backtraces = 0
Restart all workers after changing these settings
These steps only block some of the known attack paths. Updating remains the real solution.
Why This Matters for Business Owners
You do not need to understand the technical details. What matters is this:
An attacker can take full control of the server that runs your website.
They can steal customer data, install malware, or use your site to attack others.
The attack works without any password or special access.
If your site is public and runs an unpatched PHP version, treat this as urgent.
How Finepher Can Help
At Finepher we help businesses keep their websites secure and up to date. If you are unsure which PHP version you are running, or you need help applying the update safely, reach out to us. We can check your setup and guide you through the fix.
Staying current with security patches is one of the simplest and most effective ways to protect your online presence.
Update today. Your website (and your customers) will thank you.