The PHP project shipped fixes for two critical remote code execution bugs on October 21, 2026. But the details had leaked a day earlier, and Amazon's honeypots reportedly saw exploit attempts days before that.

So the question is not "is there a patch". It is "is the patch inside the container that is serving traffic right now".

TL;DR (for non-technical readers)

Two serious flaws in PHP, the language behind a large share of websites, let a stranger take over a web server with a single crafted request.

The fix exists. But fixing the software and fixing your running website are two separate steps, and the second one is easy to forget.

If your company runs anything built on PHP, the cost of waiting is a possible breach, not just a bug.

Ask your tech team one thing: "Which PHP version is running in production right now, and how do you know?"

What happened

The two bugs are CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell.…