Information as of 26 October 2026. On 21 October 2026, the PHP project announced two critical security issues, CVE-2026-109618 and CVE-2026-109619, commonly referred to together as PHP2Shell. The project released security updates that address the issues in the PHP runtime.
For a business, the key step is to check the PHP environment behind the website. Updating WordPress or another content management system, its plugins or theme alone may not address an issue in the PHP runtime itself.
Affected PHP versions and security updates
The PHP project lists the same affected and patched version ranges for both advisories. If your PHP branch is below the patched version shown, contact your hosting provider or administrator to arrange the update. Confirm your exact branch and build before making changes.
| PHP branch | Affected versions | Patched version |
|---|---|---|
| PHP 8.2 | Earlier than 8.2.35 | 8.2.35 |
| PHP 8.3 | Earlier than 8.3.36 | 8.3.36 |
| PHP 8.4 | Earlier than 8.4.27 | 8.4.27 |
| PHP 8.5 | Earlier than 8.5.12 | 8.5.12 |
Start by identifying who maintains the website
Confirm the hosting provider, the PHP version in use, the website platform and the person or supplier responsible for maintenance. Include other company websites and test environments so that updates are not limited to the main site.
Plan a PHP security update
Ask the hosting provider or system administrator which security update applies to your current version and operating system, then schedule the upgrade. Check backup and recovery arrangements beforehand. After the update, review key website functions, error logs and administrator sign-in records. If PHP is managed by your hosting provider, follow its security update notice.
If you cannot update immediately
Contact the hosting provider or IT support promptly to discuss available risk-reduction steps and a firm update schedule. Temporary measures do not replace a security update. A website loading normally does not confirm that its runtime is secure.
Include PHP in routine maintenance
Website security includes more than design and plugin management. It also depends on the server, PHP runtime, backups and a reliable update process. Connet One can help businesses review their website environment and coordinate next steps with the website or hosting provider.
Official sources
- PHP official 2026 news and security announcements
- PHP project advisory for CVE-2026-109618
- PHP project advisory for CVE-2026-109619
Information checked on 26 October 2026. Follow the latest guidance from the PHP project and your hosting provider.