01 /
Remote code
execution
Exploitation of either vulnerability can allow an unauthenticated attacker to execute code on an affected PHP server.
SERVER COMPROMISE INDEPENDENT SECURITY BRIEFING 21 OCT 2026
CVE-2026-109618 / CVE-2026-109619
PHP2Shell.The vulnerability is critical.
Your response can be clear.
Two critical flaws in PHP's core engine can enable unauthenticated remote code execution and memory disclosure. Know your exposure. Find the right fixes. Act with confidence.
Evidence-led summary Local-only version check AI-assisted discovery
THREAT INTELLIGENCE / 00121.10.2026
CRITICAL SEVERITY
9.2/ 10 CVSS v4.0
DISCLOSURE21 October 2026
TRACKED AS2 critical CVEs
POTENTIAL IMPACTRemote code execution
RECOMMENDED ACTIONPatch immediately
01 / UNDERSTAND
What's at stake?
These are vulnerabilities in PHP itself, not just in a particular plugin, CMS or application. Exposure depends on your runtime and deployment.
Remote code
02 /
Sensitive memory
exposure
Some exploitation paths can disclose PHP worker memory, potentially exposing session material or other secrets.
DATA EXPOSURE03 /
Application-agnostic
risk
The affected code lives inside PHP. WordPress, Drupal, Joomla and custom applications all warrant runtime review.
PHP COREBased on disclosures from the PHP project and Wiz Research. An affected version does not prove exploitation.
RESEARCH CONTEXT / AI-ASSISTED DISCOVERY
The flaw was old. The intelligence was new.
Researchers uncovered these long-standing PHP flaws with help from frontier AI. Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. Human-led research, amplified by AI — and a glimpse of how security discovery is changing.
02 / ASSESS
Know your
patch status.
Compare a PHP version with the PHP project's 21 October 2026 upstream security releases. Your input never leaves this browser.
Check the web runtime. The version reported by php -v in your shell may differ from PHP-FPM, Apache or an embedded runtime. Distribution packages may carry backported fixes.
// LOCAL VERSION ANALYSIS
TRY AN EXAMPLE
AWAITING INPUT
Ready when you are.
Enter a PHP version above to compare it with published upstream fixes.
Informational comparison only. This is not a vulnerability scan, an exploit test or confirmation that your entire stack is secure.
03 / VERIFY
Patched releases.
Official upstream PHP versions released on 21 October 2026. Use your OS or hosting vendor's advisories when backported patches apply.
| PHP branch | Upstream fixed in | Status | Details |
|---|---|---|---|
| PHP 8.5 | 8.5.12 | PATCH AVAILABLE | Release notes ↗ |
| PHP 8.4 | 8.4.27 | PATCH AVAILABLE | Release notes ↗ |
| PHP 8.3 | 8.3.36 | PATCH AVAILABLE | Release notes ↗ |
| PHP 8.2 | 8.2.35 | PATCH AVAILABLE | Release notes ↗ |
| PHP 8.1 and older | No supported upstream release | END OF LIFE | Support policy ↗ |
Some operating systems and long-term support vendors backport fixes without changing the upstream version number. PHP also published minimal source backports for certain older branches. Always review your vendor's security bulletin.
04 / RESPOND
Your next moves.
Practical priorities for teams responsible for production PHP infrastructure. Patch before relying on partial mitigations.
01
Inventory PHP runtimes
Check internet-facing sites, containers, appliances and hosting environments. Distinguish CLI PHP from the actual web-serving runtime.
02
Apply vendor updates
Move to a fixed upstream release or a documented, vendor-patched distribution package. Include embedded PHP and container base images.
03
Restart & validate
Restart affected workers or services, then confirm the active runtime loads the corrected package across all nodes.
04
Investigate exposure
Review logs and relevant security guidance. If compromise is suspected, follow your incident response process and preserve evidence.
!
Unable to patch immediately? Follow the PHP project's temporary mitigation guidance. These measures address individual attack paths, but the PHP project explicitly says only applying the fix is a complete solution.
Read primary advisory05 / SOURCES
Follow the evidence.
For a fast-moving security event, trust original disclosures and maintainers over unverified exploit summaries.
01PHP projectOfficial security advisory, fixes and mitigation guidancePRIMARY SOURCE02Wiz ResearchOriginal research and technical impact analysisRESEARCH03OpenAI — Patch the PlanetAI-assisted discovery, responsible disclosure and coordinated responseRESEARCH04NCSC-NL / GitHubOperational vulnerability status and defensive guidanceRESPONSE05CloudflareWAF mitigation context and coordinated disclosureMITIGATION
EDITORIAL NOTE
This page summarizes information publicly available on . Security advisories may change. Always verify the latest updates with the PHP project and your software vendors.
06 / FAQ
A few more answers.
Is this a WordPress vulnerability?
No. These vulnerabilities are in PHP itself. WordPress, Drupal, Joomla and custom PHP applications may be affected depending on the PHP runtime they use. Updating a CMS alone may not patch the PHP engine.
Does the version checker scan my website?
No. The checker runs entirely in your browser. It compares a version you enter against the upstream PHP release thresholds. It does not connect to your server, send network requests, or detect vendor backports.
Is a fixed PHP version enough to secure my site?
A fixed PHP engine addresses these identified vulnerabilities at the upstream level, but it does not guarantee overall application security. Continue routine patching and security monitoring.
What if my Linux distribution backported the fix?
A vendor may supply a patched PHP package that keeps an older-looking version number. Use the distribution's package changelog or security advisory to verify that both CVEs are addressed.
Did AI discover PHP2Shell?
AI played an important role, alongside human researchers. Calif identified a critical flaw with GPT-5.6 Sol; Wiz independently discovered the vulnerabilities using AI tools. See the OpenAI disclosure and Wiz research.