PHP2Shell: Website Outages, PHP Security Updates and What to Do
By RSINC editorial team | Updated
PHP’s October 21 security releases fix two critical vulnerabilities that can allow unauthenticated remote code execution on web servers. Visitors and website owners have different next steps. A visitor does not fix a website’s PHP installation by updating a browser or installing a download offered by an unexpected pop-up.
See checking whether an email was in a breach and password-manager options for related account protection.
What the PHP announcement confirms
The PHP project identifies CVE-2026-109618 and CVE-2026-109619. Its advisory covers PHP installations serving web requests and identifies Apache mod_php as the highest-risk configuration. The fixed upstream releases announced October 21 are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Use a current supported security release for your branch, or obtain written confirmation that your distribution or hosting vendor has applied a backported fix. A version string alone may not show a vendor backport. The PHP project says partial mitigations are not a complete fix.
If you are visiting a site
- Check the service’s established status or support channel.
- Try another unrelated site to distinguish a single-site outage from a connection problem.
- Wait if the operator announces maintenance or a temporary shutdown.
- Avoid repeated payment submissions if a checkout is failing.
- Do not install an unsolicited “PHP repair” app or provide credentials to an unexpected recovery page.
Downtime alone does not prove a data breach. A site may be offline for maintenance, a precautionary update or an unrelated failure. Follow any confirmed account instructions from the operator rather than assuming every outage has the same cause.
If you own the website
Ask the host which PHP build actually serves web requests, whether the relevant security updates are installed and whether workers were restarted as required. A command-line PHP installation can differ from the web runtime. Updating a WordPress plugin does not, by itself, establish that the server’s PHP runtime is patched.
Follow the PHP advisory and your hosting vendor’s instructions. Review application compatibility, take suitable backups and verify the site after the update. If you suspect compromise, preserve the relevant logs and involve the host or incident-response support rather than assuming an update removes every consequence.
Check the current advisory
The official PHP security notice and CISA’s October 21 bulletin are the basis for this guide. Later vendor updates can supersede the versions listed here. This article does not establish the patch status of any particular website or hosting account.
For help comparing internet at your address, call RSINC at 1-877-697-2926 or compare local providers.
Reviewed October 27, 2026. Availability, prices and terms can change.