This site is temporarily unavailable. We have taken our systems offline as a precaution due to critical PHP2Shell vulnerabilities. We can still be reached via our social media channels.
PHP is a versatile scripting language capable of creating dynamic web pages. 69.3 percent of all websites worldwide utilize this scripting language. PHP forms the foundation for the widely used WordPress and is also embedded in Joomla, Drupal, Magento, and other web software.
The PHP developers intended to release their patches on Thursday, but information regarding the vulnerabilities leaked out last night. The development team will release more information at 16:00 (4:00 PM) and expects to deploy the patches at that time. Mitigating advice is circulating online, but it appears to offer insufficient protection.
The two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) hold a score of 9.2 on the CVSS v4.0 scale, which goes up to 10. This high rating is based on the severity of a vulnerability and how easily attackers can exploit it. The vulnerabilities have reportedly been present in PHP since version 5.4.0, which was released in March 2012. Attackers can publish their own web pages through these vulnerabilities. Consequently, they could potentially distribute malware. Additionally, the so-called PHP2Shell exploit makes it possible to execute custom code on vulnerable servers.
According to various security advisories, enabling session.upload_progress.enabled can help. A corresponding temporary workaround would be to enable session.use_strict_mode. Security expert Kevin Beaumont reports that the Linux kernel security module AppArmor or the hardened Linux distribution SELinux also provides protection against the exploitation of these major PHP vulnerabilities.
Furthermore, one of the two vulnerabilities reportedly relates to multipart POST requests. For websites where multi-part uploads are unnecessary, administrators can block such data requests to protect vulnerable systems. Content delivery networks (CDNs) such as Akamai and Cloudflare may also help shield PHP installations from malicious data requests intended by attackers to deliver PHP2Shell. A core PHP developer writes in a post that only patching PHP offers true protection.
The expected patches target PHP 8.2 through 8.5. These versions are still actively supported. Older versions, which are therefore also vulnerable, will officially receive no further patches. Version 8.1 reached its end-of-life status in January of this year, and version 8.0 at the end of 2023. Users of older versions are normally advised to upgrade as quickly as possible, as they otherwise remain exposed to unpatched vulnerabilities. It remains uncertain whether these older versions will truly receive no patches for these critical vulnerabilities.