Urgent PHP Vulnerability 

Two critical security vulnerabilities have recently been disclosed affecting PHP, a widely used programming language that supports numerous websites and web applications, including platforms such as WordPress and Drupal.

The vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), carry a CVSS v4.0 severity rating of 9.2 (Critical) and could allow unauthenticated threat actors to remotely execute malicious code on vulnerable web servers. Successful exploitation could lead to unauthorized system access, website compromise, service disruptions or exposure of sensitive information

What You Need to Know

PHP is widely used across websites and web applications, including those maintained by third-party website developers and hosting providers. As a result, organizations may have exposure to these vulnerabilities even when their websites are hosted or managed by an external provider.

The PHP development team has scheduled an emergency security patch release for today, October 21, 2026, at 10:00 AM Eastern Time (EDT). These updates are intended to address the newly disclosed vulnerabilities, and organizations are strongly encouraged to prioritize remediation as soon as the patches become available.

The official security updates and release information will be available through the following PHP resources:

Security updates are expected for the currently supported PHP 8.2, 8.3, 8.4, and 8.5 branches. Organizations running older, unsupported PHP versions should consider isolating their instances from the Internet and may need to upgrade to a supported version or coordinate with their hosting provider regarding alternative remediation options.

We recommend that organizations operating PHP-based websites or applications take the following precautionary measures:

  1. Identify Potentially Affected Systems: Work with your internal IT team, website administrators, or third-party hosting providers to identify websites and applications utilizing PHP and determine whether the installed versions are affected.
  2. Prioritize Security Updates: Coordinate with your website administrators or hosting providers to obtain and deploy the appropriate PHP security updates as soon as they become available. Please note that updating a website’s content management system, such as WordPress or Drupal, does not necessarily update the underlying PHP installation.
  3. Consider Temporary Exposure Reduction: For potentially affected internet-facing systems that cannot be promptly patched, consider restricting public accessibility or temporarily taking affected websites or applications offline until remediation can be completed.
  4. Review Unsupported PHP Versions: Identify installations running unsupported or end-of-life PHP versions, as these may not receive official security updates and could require upgrading to a supported version.
  5. Monitor for Suspicious Activity: Review available web server, application, and security logs for indications of suspicious activity or potential exploitation.

Important Considerations

At the time of the initial disclosure, no vendor-confirmed vulnerability-specific workarounds were available. While existing security controls, such as Web Application Firewalls (WAFs), may provide additional protection, they should not be considered substitutes for applying the appropriate security updates.

We also encourage organizations utilizing third-party website hosting or development services to proactively request confirmation that their providers have assessed these vulnerabilities and implemented the necessary remediation measures.

Dean Dorton’s Recommendation

Given the critical severity of these vulnerabilities and the potential for remote code execution, we recommend treating this advisory as a high-priority security matter, particularly for Internet-facing websites and applications.

Organizations should coordinate with their internal IT teams, website administrators, or hosting providers to identify potentially affected systems and prioritize the installation of the official security updates immediately upon availability.

Please note that receiving this advisory does not indicate that your organization has been compromised or that your systems are confirmed to be vulnerable. This notification is intended to raise awareness and encourage proactive risk reduction.

Dean Dorton will continue monitoring developments and provide additional guidance as relevant information becomes available.

Additional Information:

If you have questions or would like assistance evaluating your organization’s potential exposure, please contact your Dean Dorton advisor or the cybersecurity team.

Connect with Our Cybersecurity Team