--- title: "PHP2Shell: Critical PHP Vulnerabilities and What to Do Today" description: Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) allow remote code execution. Here is how to find exposed systems, patch fast and verify the fix. image: https://ontracsolutions.net/hubfs/Blog%20header%201200x630.png --- [Skip to Content](https://ontracsolutions.net/en/news/ai-ready-data-how-to-build-the-data-foundation-first#body) [![Link](https://ontracsolutions.net/hubfs/Ontrac%20Solution%20Landing%20Page/Link.svg "Link")](https://ontracsolutions.net/) Toggle Menu - [Home](https://ontracsolutions.net) - [Services](https://ontracsolutions.net/services) Toggle children for Services - [Agentic AI & Autonomous Systems](https://ontracsolutions.net/agentic-ai-and-autonomous-systems) - [Cloud Architecture & Automation](https://ontracsolutions.net/cloud-architecture-and-automation) - [Staff Augmentation](https://ontracsolutions.net/staff-augmentation) - [Product Design & Engineering](https://ontracsolutions.net/product-design-engineering) - [Elite Technical Talent](https://ontracsolutions.net/elite-technical-talent) - [Engineering Talent](https://ontracsolutions.net/engineering-talent) - [HubSpot Services](https://ontracsolutions.net/hubspot-services) - [Professional Services](https://ontracsolutions.net/professional-services) - [Innovation Hub](https://ontracsolutions.net/innovation-hub) - [Solutions](https://ontracsolutions.net/solutions) Toggle children for Solutions - [Scout | Remote Hiring Defense](https://ontracsolutions.net/scout-remote-hiring-defense) - [AI](https://ontracsolutions.net/genai) - [Cloud Solutions](https://ontracsolutions.net/cloud-solutions) - [Data Analytics](https://ontracsolutions.net/data-analytics) - [FinOps](https://ontracsolutions.net/finops) - [Product Design & Development](https://ontracsolutions.net/product-design-development) - [About](https://ontracsolutions.net/about-us) - [News](https://ontracsolutions.net/en/news) - [Careers](https://ontracsolutions.net/careers) - [Contact us](https://ontracsolutions.net/contact-us) [back to blog](https://ontracsolutions.net/en/news) [Cloud](https://ontracsolutions.net/en/news/topic/cloud) # PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Business and What to Do Today Read Time **3 mins** | Written by: Kristen Siciliano [mailto:?subject=PHP2Shell%3A%20Critical%20PHP%20Vulnerabilities%20and%20What%20to%20Do%20Today&body=https%3A%2F%2Fontracsolutions.net%2Fen%2Fnews%2Fai-ready-data-how-to-build-the-data-foundation-first](mailto:?subject=PHP2Shell%3A%20Critical%20PHP%20Vulnerabilities%20and%20What%20to%20Do%20Today&body=https%3A%2F%2Fontracsolutions.net%2Fen%2Fnews%2Fai-ready-data-how-to-build-the-data-foundation-first) ![PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Business and What to Do Today](https://ontracsolutions.net/hubfs/Blog%20header%201200x630.png) **The bottom line:** Two critical vulnerabilities in PHP let attackers run code on your web servers without logging in. Patches are out now. If your organization runs WordPress, Drupal, Magento, Laravel or any custom PHP application, treat this as a same-day priority. #### **What happened** On October 21, 2026, the PHP project released emergency security updates for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now being called PHP2Shell. Both carry a CVSS v4.0 severity score of 9.2 out of 10 and allow unauthenticated remote code execution. In plain terms, anyone who can reach a vulnerable PHP application over the internet may be able to take control of the server behind it. The situation escalated quickly because details leaked before the planned disclosure date. A researcher published alleged technical details and proof-of-concept code online hours after the vulnerabilities surfaced on social media. The Australian Signals Directorate and CERT-EU both issued rare pre-patch alerts, with CERT-EU advising organizations to consider isolating internet-facing applications if they cannot patch immediately. When working exploit details are public before or at the moment a patch lands, the window between disclosure and attack shrinks from weeks to hours. Security researchers expect mass scanning to begin almost immediately. #### **Who is affected** PHP sits underneath a huge share of the web, including WordPress, Drupal and Magento, which together run millions of sites. If any part of your digital footprint uses PHP, you are likely in scope: - Marketing websites and CMS platforms - Ecommerce storefronts - Customer and partner portals - Internal tools and legacy line-of-business applications - Vendor-hosted or managed applications you may not directly control PHP 8.1 and older versions, including 7.x and 5.x, will not receive a fix from the PHP project. Those systems need an upgrade, not a patch, and they are the highest-risk assets in most environments. #### **What to do today** 1. **Inventory every PHP system.** Include production, staging, dev servers, container base images and third-party hosted apps. Unknown systems are the ones that get breached. 2. **Patch supported versions immediately.** Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the equivalent package from your Linux distribution. 3. **Restart the runtime.** PHP-FPM or the web server must be restarted for the patched interpreter to load. A patch that is installed but not running does not protect you. 4. **Contact your hosting providers.** On shared or managed hosting, your provider controls the PHP version. Ask them to confirm in writing that the fixed build is live. 5. **Isolate what you cannot patch.** For end-of-life PHP versions, apply interim mitigations and restrict internet access until the system is upgraded. 6. **Verify and monitor.** Confirm running versions on every host, then review logs for unusual activity since October 20. #### **Why speed is the whole game** Most organizations do not lose to sophisticated attacks. They lose to the gap between a patch being available and a patch being applied. For a 9.2-severity, no-login-required flaw with public exploit details, that gap is measured in hours. The challenge is rarely knowing what to do. It is having enough skilled hands to do it across every system at once, while the rest of the business keeps running. #### **How Ontrac helps** Ontrac Solutions provides rapid security and engineering support for organizations that need to move faster than their internal team's bandwidth allows: - **PHP exposure assessment:** We identify every PHP asset in your environment, including the ones nobody remembers, and rank them by risk. - **Patching assistance:** Our engineers apply, restart and verify updates across your servers, containers and hosting providers. - **Legacy PHP upgrades:** For systems stuck on PHP 8.1 or older, we plan and execute the upgrade and resolve the code compatibility issues that usually stall it. - **On-demand engineering capacity:** Need extra developers or DevOps engineers this week? Our staff augmentation team can plug into your environment quickly. *Sources:*[*iTnews*](https://www.itnews.com.au/)*,*[*Help Net Security*](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/)*,*[*CERT-EU*](https://cert.europa.eu/publications/security-advisories/2026-018/)*,*[*Tenable*](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)*. This post reflects information available as of October 21, 2026, and will be updated as details evolve.* Or start with [a PHP Security Assessment](https://ontracsolutions.net/php-security-assessment). Want to talk it through? Book a free 30-minute call with Owais Yusuf or Chris Hellman. [Book a call with us](https://ontracsolutions.net/book-a-call) ## Framework Will Help You Grow Your Business With Little Effort. [Get Started](https://ontracsolutions.net/contact-us) ##### Kristen Siciliano Share the Love [mailto:?subject=PHP2Shell%3A%20Critical%20PHP%20Vulnerabilities%20and%20What%20to%20Do%20Today&body=https%3A%2F%2Fontracsolutions.net%2Fen%2Fnews%2Fai-ready-data-how-to-build-the-data-foundation-first](mailto:?subject=PHP2Shell%3A%20Critical%20PHP%20Vulnerabilities%20and%20What%20to%20Do%20Today&body=https%3A%2F%2Fontracsolutions.net%2Fen%2Fnews%2Fai-ready-data-how-to-build-the-data-foundation-first) You May Like These ## Related Articles ![Cloud architect pointing at a wall screen titled The Four Gravity Tests, the framework for choosing between AWS, Azure and GCP at a mid-market company](https://ontracsolutions.net/hs-fs/hubfs/AI-Generated%20Media/Images/aws-azure-gcp-four-gravity-tests-featured-2to1.jpg?width=700&name=aws-azure-gcp-four-gravity-tests-featured-2to1.jpg) Cloud ### [AWS vs Azure vs GCP for Mid-Market: How to Actually Choose](https://ontracsolutions.net/en/news/aws-vs-azure-vs-gcp-mid-market) AWS, Azure or Google Cloud? For a mid-market company the answer is fit, not features: four gravity t... Keep Reading ![Product team reviewing a wall screen titled The Five Handoffs, the model for combining user-centered design with cloud-native architecture in one pipeline](https://ontracsolutions.net/hs-fs/hubfs/AI-Generated%20Media/Images/five-handoffs-ucd-cloud-native-featured-2to1.jpg?width=700&name=five-handoffs-ucd-cloud-native-featured-2to1.jpg) Cloud ### [How to Combine User-Centered Design and Cloud-Native Architecture: One Delivery Pipeline](https://ontracsolutions.net/en/news/user-centered-design-cloud-native-architecture) How to combine user-centered design with cloud-native architecture for a new digital product: five h... Keep Reading ![Team reviewing a Four Dials of AI Spend framework board - Model Fit, Architecture, Usage Shape, Accountability - in an office meeting](https://ontracsolutions.net/hs-fs/hubfs/AI-Generated%20Media/Images/AI%20Office%20Flowchart%20Discussion.png?width=700&name=AI%20Office%20Flowchart%20Discussion.png) Cloud ### [FinOps for AI Workloads: Controlling the Cost of Inference](https://ontracsolutions.net/en/news/finops-ai-workloads-inference-cost) AI spend behaves differently from cloud spend. The four dials that control inference cost: model fit... Keep Reading ![](https://ontracsolutions.net/hs-fs/hubfs/ogoni.png?width=16&height=18&name=ogoni.png) Meet Scout ## Scout Screens Candidates Before You Ever Pick Up the Phone Hiring fraud is quietly costing recruiting teams hours every week — fabricated resumes, spoofed identities, and candidates who don't exist. **Scout is Ontrac's** AI recruitment screening agent, built to catch the red flags before they cost you an interview. - Runs every applicant through a multi-point Trust Check before a human ever gets on a call - Builds a Trust Score that gives your team one clear, defensible read on a candidate - Flags risk in plain language, with the reasoning attached - Reduces wasted interview cycles and protects your hiring pipeline [See Scout in Action](https://ontracsolutions.net/scout-remote-hiring-defense) Trust check REQ-2291 JM Jordan M. Sr. Account Executive Reviewed Trust Score Identity and history signals check out 85/100 - Identity verification Passed - Resume consistency Passed - Employment history Review Scout's note: *"12-month gap between roles isn't addressed anywhere in the resume."* [![Ontrac Solutions](https://ontracsolutions.net/hubfs/OntracSolutionsWhite.svg.svg "Ontrac Solutions")](https://ontracsolutions.net/) Sign up to searing weekly newsletter to get the latest updates ## Let's talk Business? #### Services - [Professional Services](https://ontracsolutions.net/professional-services) - [Staff Augmentation](https://ontracsolutions.net/staff-augmentation) - [Innovation Hub](https://ontracsolutions.net/innovation-hub) #### Contact Us [**inquire@ontracsolutions.net**](mailto:inquire@ontracsolutions.net) Have a question? Feel free to reach out. We love to hear from you! - - - - © 2026 Ontrac Solutions [Cookie Policy](https://ontracsolutions.net/cookie-policy) [Privacy Policy](https://ontracsolutions.net/privacy-policy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Kristen Siciliano", "url" : "https://ontracsolutions.net/en/news/author/kristen-siciliano" }, "dateModified" : "2026-10-21T18:50:42.395Z", "datePublished" : "2026-10-21T16:29:50.000Z", "headline" : "PHP2Shell: Critical PHP Vulnerabilities and What to Do Today", "image" : [ "https://ontracsolutions.net/hubfs/Blog%20header%201200x630.png" ], "mainEntityOfPage" : { "@id" : "https://ontracsolutions.net/en/news/ai-ready-data-how-to-build-the-data-foundation-first", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://ontracsolutions.net/hubfs/OntracSolutions-1-padded-50.png" } } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Data an AI system can reach, trust, and interpret the way your business intends: consolidated where machines can access it, deduplicated and current enough for the use case, defined in writing so terms compute consistently, and governed by named owners. Readiness is always relative to a use case — data can be ready for a support assistant and nowhere near ready for financial forecasting." }, "name" : "What does AI-ready data actually mean?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. A warehouse or lakehouse helps once several use cases need joined, historical data, and many first use cases run well against the APIs of the systems you already operate. Treat re-platforming as something a specific use case justifies, not as a prerequisite ritual. What you cannot skip is knowing where the data lives and what state it is in." }, "name" : "Do we need a data warehouse before we can use AI?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No — clean what the pilot will touch, to the standard the pilot needs. Whole-estate cleanup before any AI ships is the most common way disciplined companies turn a foundation into a two-year program. Build outward from use cases and let each one extend the clean footprint." }, "name" : "Should we clean all our historical data before an AI pilot?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A business leader with authority over the processes the data describes, with IT or a data team as the builder. Every layer contains business decisions — which definition wins, which records merge, what an AI may act on — that a purely technical owner cannot settle. Per-dataset ownership then sits with the team that runs the corresponding process." }, "name" : "Who should own the data foundation?" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://ontracsolutions.net/#organization", "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://ontracsolutions.net/hubfs/logo.png" }, "name" : "Ontrac Solutions", "sameAs" : [ "https://www.linkedin.com/company/ontracsolutions" ], "url" : "https://ontracsolutions.net" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://ontracsolutions.net/#localbusiness", "@type" : "LocalBusiness", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Chicago", "addressRegion" : "IL", "postalCode" : "60611", "streetAddress" : "500 N Lake Shore Dr" }, "geo" : { "@type" : "GeoCoordinates", "latitude" : 41.8781, "longitude" : -87.6298 }, "image" : "https://ontracsolutions.net/hubfs/logo.png", "name" : "Ontrac Solutions", "openingHoursSpecification" : [ { "@type" : "OpeningHoursSpecification", "closes" : "17:00", "dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens" : "09:00" } ], "priceRange" : "$$", "telephone" : "+1-872-285-5044", "url" : "https://ontracsolutions.net" } ```