.png "Global Insight")
Millions of websites run on PHP — and right now, PHP has a serious problem. Two critical, unpatched remote-code-execution flaws dubbed "PHP2Shell," rated 9.2 out of 10 on the CVSS severity scale, have leaked into the open. Emergency patches ship at 14:00 UTC today, October 21. If you run a PHP site, this one is for you.
What are the PHP2Shell flaws?
According to The Hacker News, PHP will release an out-of-cycle security update today for two critical RCE vulnerabilities. The identifiers CVE-2026-109618 and CVE-2026-109619 come from the leak itself, not from PHP's official notice — and "PHP2Shell" is the researchers' nickname, not PHP's. Details leaked on October 20, with the leak claiming a perfect 10.0 score; PHP's own assessment is 9.2 on the CVSS v4.0 scale. Either way: unauthenticated attackers could potentially run code on vulnerable servers. Security firm watchTowr has confirmed the leaked details are real.
Who is affected?
Here is the uncomfortable part: only PHP branches 8.2 through 8.5 can receive fixes. Versions 8.1, 8.0, 7.x and 5.x are end of life and will get no patch. And the internet is full of them — a Shodan scan by the Mallory team counted roughly 884,000 internet-facing hosts still reporting PHP 8.1 or older as of October 20, out of about 1.5 million hosts reporting any PHP version, via The Hacker News. The expected fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, though PHP hasn't officially confirmed those numbers. The good news, as of October 20: watchTowr and Huntress report no exploitation in the wild yet. That window may not stay open long now that details have leaked.
What to do right now
First, check your PHP version and update the moment your branch's patch lands today. If you can't patch immediately, researchers have published emergency nginx and Apache rules to blunt the attack before the fix. If you're on PHP 8.1 or older, understand the blunt truth: there is no patch coming for your version, and upgrading is the only real fix. For everyone else running a WordPress, Drupal, or Laravel site on shared hosting — your host should be patching today; verify that it did.
Follow Global Insight for clear, sourced explainers on the stories shaping the world.