PHP2Shell is the name for two critical flaws in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619. Under the right conditions they let an attacker run code on your server without logging in. Fixes shipped on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs on PHP, update it today. Sites built on EmDash are not affected, because there is no PHP in them.

Below: what happened, what to do with a PHP site right now, and whether this is a reason to change your CMS.

What happened

Researchers at Calif and Wiz found the bugs in August and reported them to the PHP team. Coordinated disclosure was planned for October 21, but the details leaked a day early. On the morning of October 21 Cloudflare reported the first exploitation attempts. The fixes came out at 14:00 UTC the same day.

Both flaws are rated 9.2 out of 10 on CVSS v4.0, and watchTowr scores them at the full 10. They go back to PHP 5.4, which covers almost every PHP server on the internet.…