Security1 hOctober 23, 2026, 10:20

PHP2Shell: sites on PHP 8.1 and older left without a patch

Attacks exploiting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, both rated 9.2, began on October 21, 2026, with fixes arriving six hours later. Patches shipped for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while PHP 8.1 and older remain vulnerable because support has ended.

DEV Community

Open source

First attacks logged at 07:43 UTC on October 21, patches released at 14:00 UTC
Fixes shipped for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
PHP 8.1 support ended on December 31, 2025, leaving no official patch
Updating a CMS such as WordPress or Joomla does not fix the PHP runtime itself

#PHP#Cloudflare

PHP2Shell will linger in OT sites well beyond 2030

Security

13 hours after PHP patch, 235 of top 20,000 sites can never get the fix

Security

PHP2Shell exposes weaknesses in coordinated vulnerability disclosure

Security

PHP2Shell: sites on PHP 8.1 and older left without a patch

PHP2Shell will linger in OT sites well beyond 2030

13 hours after PHP patch, 235 of top 20,000 sites can never get the fix

PHP2Shell exposes weaknesses in coordinated vulnerability disclosure

Cloudflare blocked millions of php2shell attacks and made its new WAF free