| Date and Time | What Happened | Source |
|---|---|---|
| 20 October | The PHP security team announced an emergency security release for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10, and advised administrators to prepare to update. | PHP project |
| 20 October | Details of the vulnerabilities leaked online before the planned disclosure date. | Reported by BleepingComputer |
| 20 October | Security firm watchTowr said it had reproduced one of the vulnerabilities (CVE-2026-109618). | watchTowr |
| 21 October, 08:34 | Patchstack reported that multiple active exploitation incidents had been confirmed. | Patchstack |
| 21 October | Cloudflare reported early attacks and added firewall rules to block known attack methods for sites using its network. | Cloudflare |
| 21 October | CERT-EU published Security Advisory 2026-018, warning that all PHP versions from PHP 5 onwards could be affected. | CERT-EU |
| 21 October | EU cybersecurity agency warning, as reported by RTÉ | RTE |
| 21 October, 15:00 | Scheduled release of patched PHP versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35 expected). | PHP project |
What has happened in detail
On 20 October 2026, the PHP project announced an emergency security release for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical, with a score of 9.2 out of 10. They have been nicknamed “PHP2Shell”.
These flaws could allow an attacker to run their own code on a web server without needing a username or password. In practical terms, an attacker could take control of an affected website, change its content, steal data or use the server to launch further attacks.
CERT-EU, the cybersecurity service for EU institutions, has published an advisory stating that all PHP versions from PHP 5 onwards could be affected. Details of the flaws leaked before the fix was ready, and security companies, including Cloudflare and Patchstack, have reported that attacks have already started.
Which versions are affected
The PHP project is releasing fixes for the currently supported versions on 21 October 2026. Based on early reports, the patched versions are expected to be:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older versions, including PHP 7.x and PHP 5.x, are end-of-life and are not expected to receive a fix. Websites still running these versions will stay vulnerable until they are moved to a supported PHP version.
What we are doing
Our team is monitoring the release and will apply the patched PHP versions across our hosting servers as soon as they are available.
What you should do
- Check your PHP version. In cPanel, you can see this under MultiPHP Manager or Select PHP Version. If you’re not sure, contact us and we’ll check it for you.
- Plan an upgrade if your site runs PHP 8.1 or older. Moving to a supported version is the only long-term fix. Older websites, plugins or themes may need updates before they work correctly on a newer PHP version, so we recommend testing the change first.
- Keep WordPress, themes and plugins up to date. This won’t fix the PHP flaw, but it reduces the risk of other weaknesses being used alongside it.
- Make sure you have a recent backup of your website and database.
- Be cautious of unexpected emails offering to fix this issue for you. Scammers often use news like this to contact website owners.
Need help or want your website taken offline?
If you would prefer to take your website offline while it is reviewed or upgraded, our team can do this for you. We can replace your site with a simple HTML holding page with your logo and short message, and restore it when you’re ready.
If you would like our team to take down your website, or you have any questions about this vulnerability, please contact us at support@smarthost.ie or call 01 901 9700.
Our team can help
Have further questions, or need some advice about hosting solutions for you and your business?
Our team are on hand to assist you and get your business online. Why not give us a call on (01) 901 9700 or send us an email at support@smarthost.ie. We will get back to you as soon as possible.
