Two Critical PHP Flaws Land — Patch Now
Two new critical vulnerabilities in PHP itself — CVE-2026-109618 and CVE-2026-109619, both part of what researchers are calling “PHP2Shell” — are rated CVSS 9.2 and can lead to remote code execution (RCE) on an affected server. On October 21, 2026, CISA issued an alert requiring immediate patching, and php.net released security fixes. These are not a third-party plugin issue; they are in the PHP core, so the only reliable fix is to update PHP to a fixed version.
What’s Affected
PHP is the engine behind most small-business websites, customer portals, and WordPress sites, which is why a core-level flaw like this matters to even the smallest shops. Anything still running an older build is exposed until it is updated.
The fixed versions php.net released are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Those are the versions to update to — anything older in each branch is affected. PHP 8.1 and earlier are unsupported and have reached end of life, so there is no official fixed release for them.
The CVSS 9.2 score is the php.net CVSS v4.0 rating; under the older CVSS 3.x scale the same flaws score 9.8 — either way, this is critical.
Exploitation Status
Here is the important nuance, and it’s worth stating plainly: CISA has not observed successful exploitation of these vulnerabilities in the wild. CISA’s own October 21 alert notes that “while they pose a risk if left unpatched,” there was no confirmed CISA-observed exploitation, and neither CVE appears in CISA’s Known Exploited Vulnerabilities (KEV) catalog. That said, others have reported exploitation attempts, and RCE is the kind of flaw that attackers move on quickly, so you should not wait to see a public breach to act.
What to Do Right Away
The practical steps are the same for most SMB owners:
- Check your PHP version. Ask your host or MSP what version each site and portal is running on. Anything below the fixed versions above is exposed.
- Update to a fixed version. Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (the newest compatible with your site). Patching is the only reliable fix — there is no configuration workaround for a core RCE.
- On PHP 8.1 or older, take it offline until upgraded. CISA is explicit that versions 8.1 and older are unsupported, so there is no official fixed release; keep them offline until you can move them to a supported, patched version.
- Check for other old builds. Many shops run a second portal, an internal system, or an old staging site that nobody updates. Review every place PHP runs, not just the main website.
For sites in Tampa Bay and across the area, the safest move is a single coordinated update across every service that runs PHP — a quick, verifiable task a managed service provider can handle end to end. If you would rather have it checked, Virtual IT Group can review your PHP versions, your update path, and whether any service needs to be taken offline until it is patched.
How to Verify
The sources for everything above are public and primary: CISA’s October 21 alert (“Critical Vulnerabilities in PHP Require Immediate Patching”), the php.net security release for 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and the National Vulnerability Database entries for CVE-2026-109618 and CVE-2026-109619. If you are unsure whether your sites are current, that is a straightforward check — the hard part is not knowing, it is finding out on your own across every service you run.
Get a Free Security Check
Virtual IT Group offers a free security check for Tampa businesses. If you want confirmation that your PHP is current and your sites are protected, book a free security check or call 813-699-0769. Our Tampa team can also handle the update for you — see our cyber security solutions for Tampa, FL.
AI-assisted, reviewed against primary sources.