Is your PHP website at risk from newly discovered vulnerabilities?

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow an unauthenticated attacker to execute code on an affected PHP web server. The risk is highest for internet-facing systems running vulnerable PHP versions.

PHP's emergency fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches may need vendor backports or an upgrade plan. We first identify the runtime, server mode, hosting provider, and application dependencies before recommending the safest update path.

Potentially, yes. The issue is in the PHP runtime, not only in a particular CMS. WordPress, Laravel, Drupal, custom PHP applications, and other sites can be exposed when their server runs an affected PHP version. The hosting environment must be checked rather than guessed.

Limit exposure and contact your hosting or security team urgently. The NSA recommends taking an affected system offline if an immediate update is not feasible. Temporary mitigations can reduce some attack paths, but PHP's official guidance says updating is the complete solution.

We can verify the affected PHP runtime, create a backup and rollback plan, apply the appropriate patch, review PHP-FPM or web-server configuration, check logs and indicators of compromise, test the application, and document the changes. If compromise is suspected, we will escalate into containment and recovery work.

Submit the form with your PHP version, hosting provider, website details, and any warning you have received. We will review the request and contact you as soon as possible. Response time depends on the information provided, access, hosting constraints, and the condition of the website.