PHP2Shell vulnerability: latest update

Critical PHP vulnerabilities: what does this mean for you?

Our systems are safe, but some PHP systems are temporarily offline

Two critical vulnerabilities have been discovered in PHP (CVE-2026-109618 and CVE-2026-109619), better known as 'php2shell'. We ran our scans straight away. They show that LD ICT is not affected. Our own website is built on Next.js and does not run on PHP.

We took a number of systems that do run on PHP offline straight away as a precaution. These systems temporarily redirect to this page. The PHP team has now released the official security updates (today at 16:00), and we have started testing and applying the patches right away. Our aim is to get the systems back online, and secure, as soon as possible.

What is going on?

PHP is a widely used scripting language: 69.3 per cent of all websites worldwide run on it. The two vulnerabilities score 9.2 on the CVSS v4.0 scale and have been in the core of PHP since version 5.4.0 in 2012. Attackers can run code remotely with a simple network request (a POST request). This is called Remote Code Execution. It lets them take over servers completely, spread malware or steal data.

The official PHP team has just released patches for the supported versions, PHP 8.2 up to and including 8.5. Older versions (PHP 8.1 and lower) are End-of-Life (EOL) and receive no official updates. Working proof-of-concept (PoC) code has now been shared online, and active exploitation attempts are being observed. You need to act immediately.

Timeline of events (October 2026)

20 October: The critical vulnerabilities leak onto the internet ahead of schedule. The PHP security team responds straight away with an emergency warning and announces an early, worldwide emergency patch.
21 October (morning): The Nationaal Cyber Security Centrum (NCSC) advises Dutch organisations to prepare immediately to take systems offline or patch them. Security researchers publish a Proof of Concept (working code), and security companies warn of large-scale automated attacks.
21 October (15:34): The vulnerabilities are officially published through GitHub Security Advisories. Large network operators such as Cloudflare report the first active exploitation attempts in the wild.
21 October (16:00 / now): The PHP team releases the official updates. LD ICT starts its patch and update round straight away for all the client systems we manage.

Do you have a PHP website of your own?

We are happy to help you secure your environment:

Immediate check and security scan: We check straight away which PHP version your site uses and whether it is exposed to the internet.
Emergency updates (patching): We apply the newly released updates for PHP 8.2, 8.3, 8.4 and 8.5 quickly and safely for you.
Migration from outdated PHP versions: Does your site run on PHP 8.1 or older? These versions receive no updates. We help you with an urgent upgrade to a secure PHP 8.x version.
Temporary WAF protection: If you cannot update right away, we set up network filters or Web Application Firewall (WAF) rules to block malicious requests.
A modern, future-proof website: Are you thinking of leaving PHP altogether? We build modern, very fast websites on Next.js, just like our own.

Feel free to contact us for immediate help. Right now, the internet is not safe for unpatched PHP websites.

LD ICT