Skip to content 
Firms should act now to patch two newly disclosed vulnerabilities that could enable remote code execution and expose sensitive data.
What Happened
On October 21, the PHP development team released emergency fixes for two critical security vulnerabilities in PHP, a widely used programming language for web applications. Collectively known as ‘PHP2Shell,’ the vulnerabilities could allow unauthenticated attackers to execute code on an affected web server
These vulnerabilities are in PHP itself rather than in an individual website’s code. As a result, a carefully built website may still be exposed if the underlying PHP installation has not been updated.
Why It Matters
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect nearly every PHP version back to 5.4. Both are rated 9.2 out of 10 on the CVSS v4.0. severity scale. These vulnerabilities have the potential to allow attackers to engage in remote code execution, denial of service attacks, and expose sensitive customer data. Beyond these direct risks, firms are also experiencing operational disruptions, related to the vulnerabilities as some service providers, like BambooHR, are taking their services offline out of an abundance of caution.
Finally, speed is working against defenders. “Because technical details are now public, organizations should assume attackers may move quickly to develop and use exploits. Expect the gap between disclosure and widespread exploitation to be short.
What to Do Now
1. Find your PHP. Inventory every internet-facing system running PHP, including assets owned by Marketing, Investor Relations, and other teams outside IT. Check the actual PHP version on the server, not just the application version.
2. Patch and restart. Update to an available vendor-supported fixed release—PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35—and restart Apache, PHP-FPM, and other long-running PHP processes. Without a restart, vulnerable code may remain in memory. Linux distributions may have backported fixes under older-looking version numbers, so check the package changelog for the CVE numbers rather than relying on the version string.
3. Plan for older versions. PHP 8.1 and earlier no longer receive official updates, and 8.2 reaches end of life on December 31, 2026. For unsupported systems, work with the applicable vendor to obtain a supported build or develop an upgrade plan.
4. Treat workarounds as a stopgap. If you can’t patch immediately, PHP’s advisory lists configuration changes, such as disabling session upload progress and capping request sizes. The advisory is explicit that these reduce exposure along specific attack paths and don’t make a server safe. Pair any interim measure with appropriate network protections and a defined patch deadline.
5. Contact critical vendors today. Ask whether their platforms use affected PHP versions, whether remediation is complete and whether any notification obligations apply. Document their responses and remediation plans.
6. Look for signs of earlier compromise. The researchers suggest watching for unusual multipart web requests followed by memory-limit errors or repeated HTTP 500 errors, abnormally large session cookies in responses, and unexplained restarts of PHP processes. If these indicators are present, treat the matter as a potential incident and follow your organization’s incident response process.
How We Help
As of now, no firm has reported a confirmed breach through PHP2Shell. But now is the time to act, and firms should immediately begin the process of deploying PHP’s updates. Attackers are certainly aware of these vulnerabilities, which makes the risk of exploitation of unpatched sites higher.
ACA Aponix helps organizations strengthen cybersecurity programs, improve operational resilience, and address evolving cyber risks. Our services include:
- Aponix Protect helps firms address evolving cyber threats through a flexible and scalable cybersecurity program. The solution is designed to strengthen security practices, improve cyber resilience, and support changing business needs.
- Aponix Penetration Testing identifies exploitable vulnerabilities before threat actors can leverage them and provides actionable recommendations to strengthen security controls.
- Aponix Incident Response Planning and Tabletop Exercises help organizations validate response procedures, clarify stakeholder roles and responsibilities, and improve preparedness for cybersecurity incidents.
Contact our experts to assess your exposure, strengthen your cybersecurity posture, and reduce the risk of exploitation from emerging threats.