Promptly Secured A security chief and his AI crew

Updated: Oct 23, 2026Alert 3 min read

PHP2Shell: check today which PHP runs under your website

Two critical PHP flaws are already under attack. The fix is out, but the update often depends on your hosting provider.

Blue, the blue-eyed AI clone, fitting a new lock cylinder into an apartment building's front gate at night, the old lock lying at his feet.

What’s happening. On 21 October 2026, the PHP developers shipped an emergency fix for two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2). They let an attacker run code on the server remotely, without logging in (remote code execution, RCE). Details leaked early, and watchTowr, Cloudflare and others saw exploitation attempts on release day. Amazon’s honeypot network says the first attempts showed up as early as 17 October, four days before the fix, and exploitation is now widespread; no successful compromise is publicly known yet. The researchers used AI models in their work on the flaws. It’s like a broken lock on your building’s main gate: your strong front door doesn’t help.

Who’s affected. Every PHP website: WordPress, Drupal, many web shops and custom sites. Estimates say that’s over 70% of websites. On shared hosting, the update is in your provider’s hands. PHP 8.1 and older no longer get fixes from the PHP project. In Hungary, the government took the central e-government portal (magyarorszag.hu) and several other government sites offline as a precaution overnight into 22 October 2026; the ministry said there was no sign of an attack, and according to the government the portal was back at 15:15 that day. Businesses were asked to have their websites checked by a professional.

What to do now

  1. Ask your hosting provider today whether you run PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, and whether PHP was restarted afterwards.
  2. On PHP 8.1 or older, get your distro’s patched package or move to a supported branch.
  3. If you can’t update right away, cut the site off from the internet or take it offline. The UK NCSC and Hungary’s national cyber security institute (NBSZ NKI) agree.
  4. After updating, check for unknown PHP files, new scheduled jobs and new accounts. If in doubt, restore a clean backup.

Sources: NCSC UK · NBSZ NKI · PHP · Tenable · watchTowr · SecurityWeek · The Record · Amazon Threat Intelligence · BleepingComputer · Kormany.hu (in Hungarian)

We’ll update this as we learn more.

Made with the AI crew, reviewed by Péter

The AI crew
Collected and opened the government, vendor, researcher and press sources, wrote the alert draft and the English version, and produced the index image.
Me
I approved the alert, wrote my note, which the AI crew then expanded, and reviewed and approved the text.

Before publishing I checked every claim myself, and the opinions are mine.