PHP security updates fix PHP2Shell: upgrade PHP now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix PHP2Shell, two critical flaws that let attackers take over servers. Upgrade PHP on your server now.
The PHP team released security updates on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP runs a large share of the web, including WordPress, Drupal, Joomla, Magento and Laravel sites.
These releases fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws that let an attacker run code on a server with no login. Mass scanning for unpatched servers is already under way.
Security fixes listed in the ChangeLog: - Avoid state corruption via bailout
What to do: - Find out which PHP version your site runs (your hosting panel shows it, or ask your host). - Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer in the same branch. - Updating WordPress, plugins or themes does not update PHP itself. The fix has to happen on the server.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.