PHP2Shell Flaws: What Indian Website Owners Must Patch Now

In short: On 21 October 2026, the PHP project fixed two critical flaws, together called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can let an attacker run code on a web server without logging in. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any Indian business or department running PHP websites should find, patch and check them this week.

What Happened

On 21 October 2026, PHP released security updates for two flaws in the PHP core, according to Help Net Security and the AlmaLinux advisory published the same day. Both are rated 9.2 (Critical) on CVSS v4.0, as stated by AlmaLinux.

• CVE-2026-109618 involves memory corruption when a request hits PHP's per-request memory limit. AlmaLinux says a crafted multipart upload can trigger it.
• CVE-2026-109619 involves stale internal state that can survive from one request to the next on the same worker, leading to a use-after-free.

Help Net Security reports that a working exploit exists and that Amazon's threat intelligence team recorded an exploitation attempt on 17 October 2026, four days before public disclosure. How the attacker got the details early is not known.

The response has been unusually strong. Business Today, citing Reuters, reported that government agencies in the Netherlands and Finland temporarily took some websites offline on 21 October as a precaution, and that the FBI issued an urgent advisory the same day. The UK NCSC has urged that systems which cannot be fixed immediately be taken offline, according to Help Net Security.

Who Is Affected

According to Help Net Security, every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php setups facing the greatest danger. AlmaLinux says remote code execution was confirmed against mod_php, and against PHP-FPM for CVE-2026-109619.

In practice, this covers a very large share of websites in India: WordPress, Drupal, Joomla and Magento sites, Laravel and CodeIgniter applications, many government portals and intranet tools, and vendor products that bundle PHP inside them. Help Net Security also reports that some network and security vendors are checking their own products, so appliances may need separate updates.

The fixed upstream versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team also released source backports for PHP 7.4, 8.0 and 8.1, which are no longer officially supported. If you run an older PHP version, check with your operating system or hosting provider for a patched package.

What It Means for Indian Businesses and Departments

A flaw that needs no login and works with a single request is the kind attackers move on quickly. For an Indian company, the risk is a defaced website, stolen customer or employee data, or a server used to attack others. For a government department, a compromised portal can stop citizen services and expose personal data.

Many organisations do not have a full list of where PHP runs. Old microsites, staging servers, vendor-hosted portals and shared hosting accounts are easy to forget, and they are often the ones that stay unpatched. If a breach does happen, organisations in India should also keep in mind the CERT-In requirement to report certain cyber incidents within six hours; our CERT-In 6-hour reporting checklist explains the process. This article is general guidance, not legal advice, so check your reporting duties with your adviser.

What to Do Now

1. List every PHP system. Find all websites, portals, admin panels, staging servers and vendor products that run PHP, starting with those exposed to the internet.
2. Check the PHP version. Confirm the exact PHP version on each server, or ask your hosting provider or vendor for it in writing.
3. Patch to a fixed version. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your operating system vendor's patched package, then restart PHP-FPM or the web server.
4. Take unpatched systems offline if needed. If a public system cannot be patched quickly, follow the advice from the FBI and the UK NCSC and take it offline until it is fixed.
5. Apply temporary hardening. Where patching is delayed, AlmaLinux suggests turning off session upload progress, limiting upload and memory sizes, and removing per-directory settings that cause warnings. A web application firewall with updated rules can add a layer of protection.
6. Look for signs of attack. Review web server and PHP logs for PHP processes starting command shells or downloading files, and keep the logs safe if anything looks wrong.
7. Ask your vendors. Write to the vendors of any appliance, CMS hosting or software product that bundles PHP and ask when they will release a fix.

For a longer-term fix, a routine patch management process makes updates like this a normal weekly task rather than an emergency, and a web application firewall can buy time when a fix is delayed.

Frequently Asked Questions

Is my WordPress website affected by PHP2Shell?

WordPress runs on PHP, so if your server's PHP version is older than the fixed versions, it is exposed. Updating WordPress plugins does not fix this; the PHP version on the server must be updated.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions need a patched package from your operating system or long-term support vendor.

Has CERT-In issued an advisory on PHP2Shell?

Check the CERT-In website for the latest advisories. Whether or not one is issued, the fix is the same: update PHP to a fixed version as soon as possible.

How Affix Center Can Help

Affix Center helps businesses and government departments in Mumbai and across Maharashtra find and fix exposed systems quickly. Our cybersecurity team can help with inventory, patch checks, log review and incident response, and our IT AMC services team can keep servers and websites patched on a regular schedule.

If you are not sure whether your PHP websites are patched, contact our team today.