PHP Remote Code Execution FAQ: What You Need to Know About CVE-2026-109618 & CVE-2026-109619 (“PHP2Shell”)

If your company operates a website, an e-commerce storefront, a client portal, or custom web applications, there is an overwhelming chance your infrastructure relies on PHP. Nearly 75% of the entire web runs on it including major platforms like WordPress, Drupal, Joomla, Magento, and Laravel.

On October 21, 2026, Reuters reported an unprecedented emergency: European cybersecurity agency CERT-EU, alongside international cyber defense bodies like the Australian Cyber Security Centre (ACSC), issued urgent bulletins warning organizations that if they cannot patch immediately, they should consider taking their websites completely offline to prevent catastrophic compromise.

The cause? Two critical Remote Code Execution (RCE) flaws in core PHP – CVE-2026-109618 and CVE-2026-109619 (dubbed “PHP2Shell”) rated 9.2 out of 10.

Government portals and educational institutions in the Netherlands, Finland, and across Europe have already taken websites dark as emergency patches roll out, while global infrastructure providers like Cloudflare detect active automated exploitation across the internet. Here is a clear, plain-English breakdown of what is happening, who is impacted, when fixes are arriving, and what your business must do today.

1. The Severity: Why EU Agencies Warned Sites to Go Offline

Cybersecurity authorities rarely tell businesses to take their own websites down. When CERT-EU and allied national response teams suggest unplugging web servers, it reflects the highest tier of threat.

Because proof-of-concept exploits leaked publicly on developer forums and social media before patches could be quietly distributed, malicious actors immediately began mass-scanning internet IP addresses. Multiple European government departments, municipal agencies, and public institutions in countries like the Netherlands and Finland temporarily shut down public-facing web portals to prevent hostile intrusions while applying emergency fixes.

If national governments and multi-million-dollar digital enterprises are pulling the plug to protect their data, small and midsize businesses cannot afford to assume they will go unnoticed.

2. What Is Actually Happening? (In Plain English)

Most common website security scares involve an unpatched plugin, a flawed theme, or a stolen password. This vulnerability is fundamentally different.

It lives inside the core PHP runtime itself the underlying engine that interprets and executes code on your web server before any webpage, database query, or login screen is generated.

Here is how the attack works without the confusing computer science jargon:

• Memory Overload: An attacker sends a specially crafted, heavy request designed to overwhelm server memory.
• Abrupt Crash: The request triggers an Out-of-Memory (OOM) fatal condition. Instead of shutting down cleanly, PHP halts abruptly using an internal jump function (longjmp).
• Corrupted Memory State: Because execution was aborted midway, internal memory pointers are left dangling and half-initialized.
• Unauthenticated Remote Code Execution (RCE): During server cleanup or subsequent request cycles, the attacker exploits those broken pointers to run their own commands directly on the server completely bypassing authentication with no username or password needed.

In short: an unauthorized stranger on the internet can send malicious traffic to your site and gain the same power as an administrator sitting directly at the server terminal.

3. What Issues Can Arise If Left Unpatched?

Remote Code Execution is considered the “holy grail” for cybercriminals. If an attacker reaches an unpatched PHP instance, they can trigger severe operational and financial damage:

• Full Server Takeover (Web Shells): Attackers inject hidden backdoors allowing persistent, permanent control over your hosting environment.
• Customer & Database Exfiltration: Any database connected to the website containing client personal information, employee records, payment logs, or order histories can be downloaded silently.
• Ransomware & Complete Deletion: Criminals can encrypt your entire web directory or erase databases, demanding hundreds of thousands in extortion.
• Silent Reputation Destruction: Websites are frequently hijacked to silently host phishing schemes, distribute malware to your customers, or skim credit card numbers from checkout forms.
• Pivoting to Internal Corporate Networks: In many organizations, web servers reside on the same cloud network (AWS, Azure, private LAN) as internal business systems. A compromised web server becomes a stepping stone into your corporate infrastructure.

4. Which PHP Versions Are Vulnerable?

The vulnerability affects all actively used versions of PHP up through 8.5.11, as well as older unsupported versions.

A CRITICAL WARNING ON OLDER VERSIONS: If your website runs on PHP 8.1, PHP 7.4, or older, the PHP Group will NOT release official security patches because those versions reached End-of-Life (EOL). Running an EOL PHP version right now leaves your business defenseless against active automated scanners. You must urgently upgrade to a supported PHP release (8.2 or higher).

5. When Is It Expected to Be Fixed? (Release Timeline)

Due to the high severity and public leak of exploit code, the remediation timeline has moved at breakneck speed:

• Official PHP Core Releases: ALREADY AVAILABLE. The PHP maintenance team released official patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) on Wednesday afternoon, October 21, 2026.
• Major Linux Distributions (Ubuntu, Debian, Red Hat, AlmaLinux): Official security packages are rolling out through standard software repositories right now, with full distribution expected within 24 to 48 hours.
• Managed Web Hosting Providers (WP Engine, Kinsta, Cloudways, Pagely, SiteGround): Top-tier managed hosts have begun pushing automated runtime patches across their server fleets over a 24 to 72-hour window.
• Content Delivery Networks (Cloudflare, Fastly): Edge providers have deployed temporary WAF rules to detect and drop known exploit patterns, though experts emphasize this is only a temporary buffer not a permanent fix.
• Self-Managed & Cloud Dedicated Servers: If your business hosts its website on an unmanaged AWS EC2, DigitalOcean droplet, or private server, NO AUTOMATED PATCH IS COMING. Your internal IT or hosting administrator must manually trigger the update immediately.

6. What Can Be Done Right Now? (Action Plan)

Step 1: Contact Your Web Developer or Hosting Company Immediately

Send an urgent inquiry to your web agency or hosting provider asking: “What PHP version is our website running, and has the CVE-2026-109618 / CVE-2026-109619 security patch been applied to our server?”

Step 2: Update the PHP Engine Directly

Do not rely on web application firewall (WAF) rules or configuration tweaks in php.ini. Independent researchers at watchTowr and Tenable confirmed that configuration workarounds do not reliably stop the flaw. Updating the actual PHP binary to a patched release is the only complete fix.

Step 3: Consider Taking Unpatched or Non-Critical Portals Offline

Heed the advice of CERT-EU: if you have staging websites, internal admin portals, or client portals running on vulnerable PHP that cannot be patched within the next few hours, take them temporarily offline or restrict access behind a corporate VPN or IP allowlist.

Step 4: Audit Web Roots for Compromise

Because automated scans were detected within hours of the public leak, instruct your IT team to scan web root directories for newly added, hidden, or modified PHP files (especially in /tmp and upload directories) to ensure no backdoors were planted before patching.

THE BOTTOM LINE

When government agencies in Finland and the Netherlands take portals dark and CERT-EU recommends pulling websites offline, you know this is not a routine software update. PHP2Shell (CVE-2026-109618 & CVE-2026-109619) gives attackers unauthenticated total control over exposed servers. The patches are out but they only protect you if your hosting provider or web team actually installs them. Check your PHP version today.

Frequently Asked Questions (FAQ)

Q: Why did EU agencies recommend taking websites offline?

A: The European Union’s cybersecurity team (CERT-EU) and allied cyber centers advised this because proof-of-concept exploit code leaked publicly before all hosting providers had applied fixes. For high-risk, unpatched servers, going temporarily offline is the only way to prevent automated remote code execution until the official runtime patch is installed.

Q: Does this affect WordPress, Magento, and Drupal websites?

A: Yes. WordPress, Magento, Drupal, and Joomla are all built on PHP. While the bug is not in WordPress code itself, WordPress cannot run without PHP. If the underlying PHP engine on your server is unpatched, your entire site, customer database, and administrative dashboard are directly exposed.

Q: Can my Cloudflare or WAF firewall block this attack?

A: While cloud security providers like Cloudflare have deployed temporary edge mitigation rules to filter known exploit signatures, security researchers emphasize that WAF rules are only a stopgap. Because the flaw exists deep within PHP’s internal memory allocation logic, the only permanent defense is upgrading PHP.

Q: How do I check what PHP version my website is running?

A: For WordPress, navigate to Tools > Site Health > Info > Server, and look for “PHP version.” In hosting control panels like cPanel or Plesk, your version appears under “Server Information” or “MultiPHP Manager.” If your version is lower than 8.2.35, 8.3.36, 8.4.27, or 8.5.12, your site requires immediate updating.

Q: What happens if our site runs an old version like PHP 7.4 or 8.0?

A: Legacy PHP versions (8.1, 7.4, 5.6) have reached official End-of-Life and will not receive security patches from the PHP Group. Running these legacy versions leaves your server permanently vulnerable to public exploit tools. You must coordinate an urgent migration to a modern, supported PHP branch.

———————————————————————————————————————

Not sure whether your web servers, e-commerce applications, or customer portals are secured against PHP2Shell? Level 5 Management assists businesses with proactive server monitoring, emergency patch deployment, and managed cybersecurity. Contact our rapid response team today for a comprehensive infrastructure verification.