On October 21, 2026, the PHP project released security updates for two critical flaws that can let an unauthenticated attacker run code on a vulnerable web server. National cyber agencies in Singapore, Canada and the EU issued urgent advisories the same day. Singapore's Cyber Security Agency (CSA) has since reported widespread exploitation attempts.
The PHP project pre-announced the fixes on October 20 and shipped them on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for older branches. CSA's alert AL-2026-151 refers to the pair as PHP2Shell and scores each at 9.2 under CVSS v4.0. In its October 23 update, CSA said it remained aware of widespread exploitation attempts and that multiple proof-of-concept exploits exist.
Other agencies describe the threat more cautiously. The Canadian Centre for Cyber Security reports that a proof of concept is available, but it had not identified active exploitation as of its October 23 update. It also warns that this could change quickly. The joint EU statement from the European Commission, ENISA, CERT-EU, Europol EC3 and the EU CSIRTs network does not report exploitation, and those bodies say they are monitoring.
The two flaws are CVE-2026-109618, a memory handling flaw triggered during out-of-memory conditions, and CVE-2026-109619, a use-after-free flaw. Both can lead to remote code execution without authentication. Supported branches are affected before the fixed versions listed above. PHP 8.1 and older no longer receive official updates, although some distributions and long-term support vendors ship backported fixes.
The Canadian Centre's October 23 update adds a third issue, CVE-2026-115560. Exploiting it requires an uncommon combination of PHP configuration and application behavior, and the October 21 releases do not fix it. Until a patch is available, the Centre advises setting session.upload_progress.enabled=0.
PHP runs a large share of the web, and much of it sits inside products that teams do not think of as PHP: content management systems, vendor appliances, admin panels and container images. A patching plan that covers only the main website will miss these. That is why every agency above tells organizations to identify third-party products that bundle PHP, not only their own code. The question for a security leader this week is whether the asset inventory can answer "where do we run PHP, and who patches it?" within a day. If the answer depends on a vendor, the vendor's patch timeline is now part of your risk.
Patch internet-facing systems that handle untrusted input first. Where patching has to wait, isolate those systems from public networks. Then review web server, application and endpoint logs for unexpected processes, files, accounts or outbound connections, because proof-of-concept code is already circulating. Teams with continuous monitoring in place will see exploitation attempts sooner than teams relying on a patch date alone.
Agencies disagree on whether exploitation is confirmed. No agency has named threat actors or confirmed victims. A fix for CVE-2026-115560 had not been released at the time of writing.
1. Critical Vulnerabilities in PHP (AL-2026-151), Cyber Security Agency of Singapore, October 21, 2026, updated October 23, 2026. Confirms CVE IDs, CVSS v4.0 scores of 9.2 and reports of widespread exploitation attempts.
2. AL26-026: Critical vulnerabilities impacting PHP, Canadian Centre for Cyber Security, October 21, 2026, updated October 23, 2026. Confirms affected and fixed versions, CVE-2026-115560 and its mitigation, and that active exploitation had not been identified.
3. Joint statement on critical PHP vulnerabilities, ENISA, European Commission, CERT-EU, Europol EC3 and EU CSIRTs network, October 21, 2026. Confirms release timing and recommendations for EU organizations.
