On 21 October 2026 the PHP team released emergency updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, together “PHP2Shell”, 9.2 each on CVSS 4.0). They sit in the runtime, not in an application: even a “Hello World” page on a vulnerable PHP version can be attacked, without any account. The fix is in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 . Researchers at Wiz, Calif and OpenAI found them.

Why updating the application is not enough

Updating WordPress, Laravel or Nextcloud changes nothing about the PHP version underneath. That comes from the server package, the host or the container image. According to the PHP advisory every way of running PHP is affected (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). mod_php is the most dangerous: a single request can trigger the attack before any application code runs.…