Two Critical PHP Flaws Put Millions of Websites at Risk, and Older Versions Will Not Get a Fix

Cisco Talos is tracking two critical vulnerabilities in PHP core, together dubbed "php2shell". Tracked as CVE-2026-109618 and CVE-2026-109619, both score 9.2 on the CVSS v4.0 scale. An attacker does not need to log in: a plain HTTP request can trigger the flaws, and they can be exploited before any application code runs. Every PHP build since 5.4 is affected. Talos notes that artificial intelligence appears to have played a key role in discovering them, adding to pressure on organisations' patching processes.

Because the problem sits in PHP itself, the potential exposure is wide. Applications running affected versions may include WordPress, Drupal, Magento, Shopware, WooCommerce and Laravel, as well as PHP sites hosted through cPanel or Plesk. Talos assesses that all industries running PHP applications are at risk if systems stay unpatched, and that both state-sponsored and financially motivated groups, including ransomware actors, commonly exploit this type of flaw.

The bigger concern is older software. PHP 8.1 and older have reached end of life, and PHP 8.2 security support ends on 31 December 2026. Talos estimates around 50% of PHP systems will not receive a patch, and there is no patch for PHP 8.1 or older. Talos very strongly advises updating to PHP 8.2 or later. As of 21 October 2026, 14:00 UTC, Talos had not seen exploitation in the wild. Cisco customers are covered by Snort signatures 67359 and 67360, also available in the Community Ruleset.