This story was written with the assistance of an AI writing program and edited by the author.

If you run anything on PHP, the last couple of weeks have been noisy. On 21 October the PHP project shipped emergency fixes for two critical bugs, nicknamed PHP2Shell , and the reaction has swung between "this is Log4Shell for the web" and "relax, the public exploits don't even work." Both camps have a point.

I'm Adnan Shakir, Head of Technical Development at Grafdom, a web agency in Dubai. This is my attempt to separate what's confirmed from what's hype, explain how the bugs actually work, and give you something practical to run on your own servers. Everything below is accurate as of 4 November 2026, and the sources are linked at the end.

TL;DR

PHP2Shell is two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (CVSS v4.0) and can allow unauthenticated remote code execution (RCE).

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.…