PHP2Shell vulnerability: the latest update

Critical PHP vulnerabilities: what does this mean for you?

Our systems are safe, but some PHP systems are temporarily offline

Two critical vulnerabilities have been discovered in PHP (CVE-2026-109618 and CVE-2026-109619). We ran our scans straight away. They show that LD ICT is not affected. Our own website is built on Next.js and does not run on PHP.

As a precaution, we have switched off a number of systems that do run on PHP. These systems temporarily redirect to this page. Once the security updates are available and have been applied, we will put them back online.

What is going on?
PHP is a widely used scripting language: 69.3 per cent of all websites worldwide run on it, including WordPress, Joomla, Drupal and Magento. The two vulnerabilities score 9.2 on the CVSS v4.0 scale (out of a maximum of 10) and have been present in PHP since version 5.4.0 in 2012. Attackers could potentially use them to publish their own pages, spread malware and even run their own code on vulnerable servers. The PHP team expects to release patches today for PHP 8.2 through 8.5. Older versions no longer officially receive patches.

Do you have a PHP website?
We are happy to help:

• Security scan: we check which PHP version you are running and whether your site is vulnerable.
• Patch and update management: as soon as the patches are available, we apply them quickly and safely.
• Upgrade from outdated PHP versions: for sites on PHP 8.1 or older, which no longer receive official patches.
• Temporary protection: extra layers of security until the patch is applied.
• A modern, future-proof website: we build on Next.js, just like our own site.

Feel free to contact us with any questions or if you need help.

LD ICT