24/10/2026
Is PHP in danger? 🚨
Two critical flaws were found in PHP itself, nicknamed "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619, severity 9.2/10). One web request, with no login, could let an attacker run code on a server.
PHP powers about 70% of websites, including WordPress, Laravel, Drupal and Joomla. Governments in the Netherlands, Finland, Australia and France took their own sites offline while waiting for the fix, and attacks started before the patch was even out.
✅ Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later)
✅ Retire old PHP versions
✅ Turn on firewall rules, check your logs, rotate your passwords
Not sure if your site is safe? DM us and our team will help you check.
Sources: Wiz Research, Amazon Threat Intelligence, Reuters, ABC News, CNN, Help Net Security