On 21 October 2026 the PHP project shipped an emergency security release for two critical remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". A working exploit exists and, according to reports, a single unauthenticated request can trigger it before any application code runs. This is a plain checklist of what to do, collected from the public advisories listed at the end.

1. Know the fixed versions

Branch Fixed in

8.5 8.5.12

8.4 8.4.27

8.3 8.3.36

8.2 8.2.35

8.1 and older no official release; source backports exist for 7.4, 8.0 and 8.1, otherwise ask your vendor or upgrade

Every PHP installation that serves web requests is in scope (PHP-FPM, Apache with mod_php, CGI, FrankenPHP, LiteSpeed). Setups using mod_php are described as the most exposed.

2.…