Dive into expert insights, deep analysis, and forward-looking perspectives from the minds shaping Drupal, AI, and open source innovation.
Blog Post
Jeremy Andrews - October 21, 2026
PHP2Shell: What PHP Site Owners Should Do Today
On 21 October 2026, as scheduled, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Every PHP installation that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP security team rates both 9.2 out of 10 (CVSS v4.0) and considers the risk highest for mod_php, where a demonstrated exploit runs before any application code.
