Major security alert: PHP vulnerable to critical RCE, attacks ongoing

Attacks are already under way: Patchstack has received reports of active exploitation from multiple hosting partners.

Two critical vulnerabilities in PHP itself could let attackers run their own code on affected servers. Sites built on WordPress, Drupal, Magento, Joomla, Laravel and other PHP applications are exposed if they run a vulnerable PHP version.

The only confirmed fix is updating PHP. The PHP security team has scheduled an emergency release for 21 October 2026, 14:00 UTC.

Live timeline

• 07:34 UTC – Multiple active exploitation incidents reported to Patchstack by hosting partners.
• 20 October – Details leak ahead of coordinated disclosure. The PHP security team announces the 21 October release.

What we know

• The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both Critical (CVSS v4.0 9.2). Some early reports said 10.0, but 9.2 is the official rating.
• The flaws are in the PHP interpreter, not in any one application, so any site on a vulnerable PHP version is exposed.
• Details leaked on 20 October, before the coordinated disclosure, and the issue is being called “PHP2Shell”. Security firm watchTowr confirmed the vulnerabilities are real and reproduced one of them. They are reported to allow remote code execution.
• Affected and fixed versions will be published with the release. Older, end-of-life PHP branches may not receive patches. This is unconfirmed until the release.
• A PHP core developer has said that patching or upgrading PHP is the only mitigation.
• CERT-EU has issued an advisory: https://cert.europa.eu/publications/security-advisories/2026-018/

How to protect your websites

1. Update PHP as soon as the patched versions are out at 14:00 UTC. If you’re on managed hosting, ask your host when they will apply it.
2. Find every PHP install you run (servers, containers, staging sites) so you know what needs updating.
3. If you run an end-of-life PHP version, ask your host about upgrade options now.
4. Avoid unofficial “fix” plugins and copy-pasted snippets. They are not verified and can break your site.

Partial mitigation (not a fix)

Early analysis points to PHP’s session upload progress feature, which is on by default. Some researchers suggest turning it off until you can patch:

session.upload_progress.enabled = Off

Apply it in php.ini, .user.ini or your host’s PHP settings, then reload PHP. Upload progress bars will stop working, but uploads themselves still go through.

This is only a partial mitigation and does not stop exploitation. PHP core developers have said the only way to fully mitigate the issue is to update to the new PHP version that patches the vulnerability. Treat this as a stopgap, not a substitute for updating.