PHP2Shell Vulnerabilities: What Businesses Need to Know and How to Protect Their Systems

Table of Contents

• What Is PHP2Shell?
• Why Are the PHP2Shell Vulnerabilities Serious?
• Which PHP Versions Are Affected?
• Who Should Be Concerned About PHP2Shell?
• How Businesses Can Check Their PHP Environment
• How to Protect Your Systems From PHP2Shell
• PHP2Shell Security Checklist
• What Businesses Should Do Next

PHP remains one of the most widely used technologies for building and powering websites and web applications. However, like any widely deployed technology, keeping PHP environments updated and secure is essential.

On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities that can allow unauthenticated remote code execution. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have been referred to as PHP2Shell. The vulnerabilities received a CVSS score of 9.2, making them a critical security concern for organizations running affected PHP environments.

The National Security Agency (NSA) has also issued an advisory recommending organizations identify vulnerable PHP systems, prioritize vendor patches, and take additional mitigation measures where necessary. Read the NSA advisory on PHP vulnerabilities

What Is PHP2Shell?

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can potentially allow unauthenticated remote code execution on affected systems. For businesses, the key priority is identifying vulnerable PHP environments and applying the appropriate security updates.

Why Are the PHP2Shell Vulnerabilities Serious?

PHP2Shell is a critical concern because affected systems may be vulnerable to remote code execution without authentication. This means attackers could potentially interact with vulnerable PHP environments remotely and execute malicious code.

The risk is particularly important for internet-facing websites, APIs, portals, and business applications running affected PHP versions.

A successful compromise could potentially lead to:

• Unauthorized access to application files or data
• Website or application modifications
• Deployment of malicious files
• Exposure of credentials or sensitive information
• Service disruption or further network compromise

The actual impact depends on the application’s configuration, permissions, and overall security controls, which makes identifying and patching affected PHP systems a priority.

Which PHP Versions Are Affected?

The PHP project released security updates for supported PHP branches to address CVE-2026-109618 and CVE-2026-109619.

The recommended fixed versions include:

The PHP project recommends upgrading to the corresponding security release. Linux distributions and long-term support vendors may also provide the fixes through their own package repositories.

Organizations running older PHP versions should pay particular attention to their support status.

PHP 8.1 and older versions no longer receive updates from the PHP project, although some operating-system distributions and long-term support vendors may provide backported security fixes.

Who Should Be Concerned About PHP2Shell?

PHP2Shell may affect organizations running PHP-based:

• Websites and web applications
• APIs and customer portals
• E-commerce and CMS platforms
• Third-party or legacy applications
• Internet-facing servers

How Businesses Can Check Their PHP Environment

Businesses should:

• Identify PHP systems: Find websites, applications, servers, and third-party software using PHP.
• Check PHP versions: Compare installed versions with the latest security releases.
• Prioritize internet-facing systems: Review publicly accessible applications first.
• Check dependencies: Review frameworks, plugins, and third-party components that rely on PHP.

How to Protect Your Systems From PHP2Shell

• Update PHP: Upgrade affected installations to the appropriate security release.
• Prioritize internet-facing applications: Address public websites, APIs, portals, and other exposed systems first.
• Replace unsupported versions: Plan migration from EOL PHP versions.
• Review logs: Look for unusual requests, processes, file changes, or outbound connections.
• Limit permissions: Ensure PHP applications and service accounts have only the access they require.
• Isolate unpatched systems: Restrict or temporarily isolate systems that cannot be updated immediately.

These measures can reduce exposure, but they should not replace applying the official PHP security updates.

PHP2Shell Security Checklist

Use this checklist to quickly assess your environment:

• Identify all systems running PHP
• Check the PHP version on each system
• Identify internet-facing PHP applications
• Upgrade affected PHP installations to fixed versions
• Check third-party applications and dependencies
• Review unsupported or end-of-life PHP environments
• Review server and application logs
• Monitor for unusual activity
• Restrict access to systems that cannot be patched immediately
• Create a plan to modernize legacy applications

What Businesses Should Do Next

At Codevision, we take a proactive approach to website and application security. We have already helped secure and maintain websites for many of our clients, helping them stay protected as security risks continue to evolve.

If your business uses PHP:

• Check your PHP version and identify affected systems.
• Apply the latest security updates to vulnerable environments.
• Prioritize internet-facing applications that may have greater exposure.
• Review older applications running unsupported PHP versions.
• Monitor and maintain your website regularly to identify potential security risks.
• Consider legacy application modernization where legacy applications create ongoing security challenges.

Need help securing or modernizing your PHP application? Contact us to assess your existing environment and identify the right approach to keep your applications secure, reliable, and up to date.