PHP2Shell: emergency PHP security patch for your website today

What happened

On 21 October 2026, the PHP team released emergency security updates: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities collectively known as "PHP2Shell" - CVE-2026-109618 and CVE-2026-109619. They are flagged both in the PHP security announcement and in CERT-EU Security Advisory 2026-018, and are also confirmed by Rapid7, Tenable and Help Net Security.

Both vulnerabilities have a CVSS v4.0 score of 9.2 out of 10, and both allow an attacker to execute code remotely without authentication. The first is a memory corruption flaw that occurs when PHP handles memory exhaustion (memory_limit), for example with specially crafted form or file upload requests. The second is a stale internal state that persists between requests and can be exploited in the next request. Security researchers already report observed attack attempts.

What it means for companies in Latvia

All PHP installations that serve web requests are affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The vulnerable code has existed since PHP 5.4, that is, since 2012.

In practice, this applies to a great many businesses, because PHP underpins:

• WordPress and WooCommerce websites and online shops;
• Joomla, Drupal and Magento solutions;
• Laravel and other custom-built company portals, request forms and customer areas.

If your website is where orders, enquiries or customer data are collected, it is part of how your business operates. A successful attack can mean not only a defaced page, but also access to data and to the server.

If your website is slow or briefly unavailable today, it is most likely not your fault. Hosting providers are installing patches en masse right now. IONOS stated on its status page that it is installing the security update on all systems, plans to finish within 24 hours, and that during this time some websites may be slow or temporarily unavailable. As a precaution, IONOS also temporarily disabled Nextcloud instances. This is normal firefighting work, and it is better to take it calmly than to expect that nothing needs to be done.

What to do in practice

The right action depends on where your website is hosted.

Shared hosting (you do not administer the server yourself):

• write to your hosting support and ask whether the patch has already been applied and which PHP version your account has been switched to;
• if the answer is "not yet", ask when it will be done;
• do not mistake brief slowness or unavailability today for your own error.

VPS or your own server:

• update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on which branch you use;
• after updating, restart PHP-FPM or Apache, otherwise the old process will keep running;
• check the version with the php -v command and also within the website environment itself;
• IONOS customers with a VPS or their own servers should update PHP themselves, as the hosting provider will not do it for you.

If you are on PHP 8.1 or an older version:

• there will be no official release for these versions; the PHP team has published only minimal source code patches for versions 7.4-8.1, intended for those who compile PHP themselves;
• in practice, this means you need to move to PHP 8.2 or newer;
• plan the move without delay, because an older version will no longer receive proper protection.

Before a major version change, create a full backup and, if possible, test it in a staging environment first. WordPress plugins, old themes and custom code may be incompatible with a newer PHP, so for an online shop this should not be done at the last minute and without a plan.

Where to start

To begin with, a few steps you can take today are enough:

1. Find out where your website lives and who is responsible for it: the hosting provider, the developer or your IT team.
2. Check the PHP version in the hosting control panel (usually under PHP or Domains/Web).
3. Compare it with the patched versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
4. If the version is older or unclear, contact the hosting provider or developer and ask for written confirmation.
5. Create a backup if a version change is coming soon.
6. Make a list of all PHP systems in the company: main website, online shop, intranet, old campaign pages, test environments. Forgotten sites are often the most vulnerable.

Over the medium term, this case shows that it is worth putting the process in order too: who follows security announcements, who is responsible for updates, and how the company finds out that the hosting provider has changed something. It is not complicated: one responsible person, a short checklist and regular update windows. Some of this can also be partly automated, for example with notifications about version mismatches.

The most important thing today: do not panic, but do not delay. Check the version, ask your hosting provider and, if necessary, schedule the move to a supported PHP version. If you need help organising the maintenance of your website and company systems, AI-Lab Space can help you build a clear process.