{
  "id": 16623599,
  "title": "How to check your server has the php2shell patch",
  "url": "https://urgent.news/2026/10/26/how-to-check-your-server-has-the-php2shell-patch",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-26T16:11:25.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/codelevel/how-to-check-your-server-has-the-php2shell-patch-2agh"
  },
  "original_language": "en",
  "account": "On 21 October, the PHP team unveiled updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, which incorporate the critical php2shell patch addressing CVE-2026-109618 and CVE-2026-109619 vulnerabilities. Both security flaws permit attackers to execute arbitrary code on the server without prior authentication, and both are currently being exploited. Organizations utilizing PHP for their websites or e-commerce platforms are strongly advised to verify whether their server processes have applied the necessary patch this week. It is essential to act promptly rather than waiting for the next maintenance window.\n\nFollowing the patch installation, it is crucial to restart PHP-FPM or Apache and rebuild any container images. The PHP team has committed to supporting PHP 8.2 until 31 December 2026. Unfortunately, the vulnerabilities have already been exploited, with initial attack attempts reported just 19 minutes after the patches were made available. By early on 22 October, Cloudflare had logged millions of such attempts.\n\nA confirmed successful takeover was reported on 26 October, targeting a honeypot server running Apache with mod_php and PHP 8.4.26. Researchers Marcus Hutchins independently confirmed the breach. Additionally, an unnamed European government body experienced a breach via an unpatched server, leaving a web shell in place to maintain unauthorized access.\n\nSeveral server configurations are susceptible to these attacks, including those running mod_php in Apache and PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Attackers have attempted over millions of times against unpatched PHP servers, making it imperative to remediate the issue without delay.",
  "summary": "On 21 October the PHP team released 8.2.35, 8.3.36, 8.4.27 and 8.5.12, the php2shell patch for CVE-2026-109618 and CVE-2026-109619 . Both flaws let an attacker run code on the server without logging in, and both are now being exploited. If your site or online shop runs on PHP, check this week that the process actually serving it has the fix. In short The flaws are being exploited, so patch now…",
  "key_points": [
    "PHP released patches for CVE-2026-109618 and CVE-2026-109619 on 21 October.",
    "Critical vulnerabilities allow attackers to execute arbitrary code without authentication.",
    "Immediate patch installation and server restarts are crucial to mitigate risks."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}