The PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, fixing two critical vulnerabilities that can allow attackers to run code on web servers without authentication. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell, affect PHP installations serving web traffic worldwide, including ecommerce platforms such as Magento and Adobe Commerce. The release came a day after technical details of the vulnerabilities leaked publicly.
Both vulnerabilities carry a CVSS v4.0 score of 9.2. According to the PHP security advisory, affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php. The vulnerable code has been present since PHP 5.4, released in 2012.
Research published by Sansec confirmed unauthenticated code execution against Magento 2.4.9, WordPress, Drupal, Joomla, Nextcloud and several other PHP applications. Because the flaws sit in the PHP runtime, the malicious request is processed before the application loads, and installations with fully updated application code remain exposed on unpatched servers. One of the two bugs can also return fragments of server memory to the requester, which may include credentials and session tokens. Cloudflare reported attack attempts at 07:43 UTC on October 21, several hours before the fixed versions were published, and an exploit tool is publicly available.
The vulnerabilities were reported by Ryan Austin of Calif, by Wiz Research and by OpenAI. The PHP security team coordinated the fix after the first report in August.
Older PHP versions
PHP 8.1 and earlier branches no longer receive updates from the PHP project. Its security team published minimal source-level backports for PHP 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors provide their own backported fixes.
For Magento, Adobe’s Commerce system requirements list PHP 8.1 as the only supported version for Magento 2.4.4 and 2.4.5. Installations on those releases cannot move to an officially patched PHP version without first upgrading Magento, a constraint outlined in a technical guide published by Meetanshi. PHP 8.2 is scheduled to reach end of life on December 31, 2026.
The PHP project has stated that temporary configuration changes, such as disabling session upload progress, reduce exposure to specific attack paths but do not make an installation safe, and that updating is the only complete fix.
Company Information
Meetanshi Technologies LLP is a software development company founded in 2017, with offices in Bhavnagar, India, and Stuttgart, Germany. The company builds extensions and applications for the Magento and Shopify ecommerce platforms.
