{"id":3298,"date":"2026-10-22T15:02:38","date_gmt":"2026-10-22T22:02:38","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3298"},"modified":"2026-10-30T13:19:18","modified_gmt":"2026-10-30T20:19:18","slug":"php2shell-why-patching-your-website-isnt-enough-this-time","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/php2shell-why-patching-your-website-isnt-enough-this-time\/","title":{"rendered":"PHP2Shell: Why Patching Your Website Isn&#8217;t Enough This Time"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By El Mostafa Ouchen | MAG212 CYBER | 22 October 2026<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your business runs a PHP website, whether WordPress, Drupal, Joomla, Magento, Laravel or something custom, you need to act this week. Two critical flaws in the PHP engine itself, tracked as <strong>CVE-2026-109618<\/strong> and <strong>CVE-2026-109619<\/strong> and together called <strong>\u201cPHP2Shell\u201d<\/strong>, let an attacker run code on your server or read data from its memory without logging in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The important part: <strong>the bug is not in your website. It\u2019s in the PHP runtime underneath it.<\/strong> A fully updated WordPress on an unpatched PHP server is still exposed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Key facts<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVEs:<\/strong> CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state)<\/li>\n\n\n\n<li><strong>Severity:<\/strong> Critical. CVSS v4 9.2 (PHP); NVD v3.1 9.8 for CVE-2026-109618<\/li>\n\n\n\n<li><strong>Affected:<\/strong> All web-serving PHP: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. Back to PHP 5.4<\/li>\n\n\n\n<li><strong>Fixed in:<\/strong> 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 21 October 2026)<\/li>\n\n\n\n<li><strong>Status (22 October):<\/strong> Exploit attempts confirmed; no confirmed compromises; not in CISA KEV<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What happened<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PHP shipped fixed versions on <strong>21 October 2026<\/strong>, a day earlier than planned after details leaked online. Both flaws come from PHP mishandling memory when a request ends abnormally, for example when it runs out of memory. One flaw can turn that into remote code execution. The other lets a later request reuse data that should have been wiped, which can expose <strong>passwords, session tokens, API keys and certificates<\/strong> belonging to other users.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who is affected<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Practically every PHP installation that serves web pages, going back to PHP 5.4:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Apache mod_php:<\/strong> the easiest target, exploitable with default settings<\/li>\n\n\n\n<li>PHP-FPM, php-cgi, FrankenPHP and LiteSpeed<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Estimates of exposed servers range from <strong>1.3 million to over 5 million<\/strong>, depending on who is counting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is anyone being attacked?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attack <strong>attempts<\/strong> are confirmed. Security networks recorded probing as early as 17 October, before the public announcement, and scanning spread across the internet within hours of the leak. As of 22 October, <strong>no successful break-in had been publicly confirmed<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is not the same as \u201cno one was hacked.\u201d A successful attack can return a normal page and leave nothing in your website\u2019s logs. Several organizations, including BambooHR and the Dutch government\u2019s DigiD service, briefly took systems offline as a precaution. The UK\u2019s NCSC told organizations to update immediately or take affected systems offline.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to do now<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Update PHP and restart it.<\/strong> The fixed versions are <strong>8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/strong>. Restart every PHP process afterward; installing the update alone isn\u2019t enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. If you\u2019re on hosting, ask your provider today:<\/strong> \u201cWhich PHP version is my site running, and has it been patched for CVE-2026-109618 and CVE-2026-109619?\u201d On shared hosting, managed WordPress or an agency-run server, PHP is usually their responsibility, not yours. Get a written answer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Can\u2019t patch yet?<\/strong> Put your site behind a web application firewall; Cloudflare has enabled protective rules on all plans. Also apply PHP\u2019s interim settings, which block known attack paths: set <strong>session.upload_progress.enabled = 0<\/strong> and <strong>fatal_error_backtraces = 0<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Assume secrets may have leaked.<\/strong> If your site ran a vulnerable PHP version on the internet after 17 October, change your database passwords, API and payment keys, and admin passwords, and log out all sessions. Do this even if you find no sign of a break-in, because the memory-leak attack leaves almost no trace.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Check for old PHP.<\/strong> PHP 7.3 and older will <strong>never<\/strong> get a fix. PHP 8.1, 8.0 and 7.4 have only source-code patches unless your Linux vendor provides one. PHP 8.2 reaches end of life on 31 December 2026. If your site runs any of these, plan an upgrade now.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The bigger lesson<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Most businesses update their website and plugins and assume they\u2019re covered. PHP2Shell shows the danger sits one layer down. The organizations hit hardest won\u2019t be the ones that patch slowly. They\u2019ll be the ones that can\u2019t say, within minutes, which PHP version each server runs and who is responsible for updating it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Find out today who owns your PHP runtime.<\/strong> That one answer decides how fast you can respond, this time and next time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>The full technical report, with firewall rules, detection queries and an incident response checklist, is available in the MAG212 CYBER magazine. Information is current to 22 October 2026; check PHP\u2019s official advisories before acting, as patch and exploitation status are changing quickly.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading mag212-related\">Related coverage on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list mag212-related-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/php2shell-patch-the-runtime-not-just-the-site-cyber-mag212-special-report\/\">PHP2Shell: Patch the Runtime, Not Just the Site | CYBER.MAG212 Special Report<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/shell-week-php2shell-node2shell-and-the-race-between-the-leak-and-the-patch\/\">Shell Week: PHP2Shell, Node2Shell and the Race Between the Leak and the Patch<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/black-october-2026-php2shell-emudhra-gitlab-and-litellm-what-happened-and-what-to-do-now\/\">Black October 2026: PHP2Shell, eMudhra, GitLab and LiteLLM \u2014 What Happened and What to Do Now<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/polyshell-cve-2026-48356-magento-cms-block-loader\/\">PolyShell (CVE-2026-48356)\u00a0: Pourquoi les boutiques Magento corrig\u00e9es ex\u00e9cutent-elles toujours un chargeur JavaScript cach\u00e9\u00a0?<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Two critical flaws in the PHP engine put millions of websites at risk, even fully updated WordPress sites. What happened, who is affected, and five steps to take now.<\/p>","protected":false},"author":1,"featured_media":3299,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[25,27,23,29,31,28,32,24,30],"class_list":["post-3298","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","tag-cisa","tag-cyber-threat-intelligence","tag-cybersecurity-news","tag-ethical-hacking","tag-incident-response","tag-network-security","tag-php","tag-ransomware","tag-zero-day-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3298","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3298"}],"version-history":[{"count":2,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3298\/revisions"}],"predecessor-version":[{"id":3651,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3298\/revisions\/3651"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3299"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}