What Happened
On October 21, the PHP project released emergency updates (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixing two critical flaws, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both can let an attacker run code on a server without logging in. The PHP team's guidance is blunt: "There are no complete mitigations, updating is the only safe choice."
On October 26, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being used in real attacks. Federal agencies have until October 29 to patch.
Why It Matters to Buyers
PHP is everywhere. It runs WordPress, many intranets and customer portals, and a lot of web-based admin tools. If your team or your hosting provider runs PHP, you are likely in scope.
The harder part is PHP you didn't install. Many vendors build PHP into their appliances and management consoles. Within days, dozens of vendors published notices. Some confirmed exposure: Okta says its Access Gateway appliance is affected before version 2026.44.0. Others, like Veeam and SonicWall (for its firewalls and the products it has reviewed so far), say they are not. You can't patch PHP inside a vendor's appliance yourself. You need their fix.
What to Do Now
- Patch your own PHP servers first. Prioritize anything reachable from the internet. Ask your hosting provider or MSP to confirm, in writing, which PHP version your sites now run.
- Build a vendor list. Pull the appliances and on-premises software in your environment (remote access gateways, NAS and backup storage, network management consoles, phone systems, building systems) and check each vendor's PHP2Shell notice.
- Ask vendors who haven't published: Does any product we run include PHP? Which version? When will a fixed build ship?
- Retire old PHP. Versions before 8.2 no longer get security fixes, and 8.2 reaches end of life on December 31, 2026. Anything older needs an upgrade plan, not just this patch.
The Bigger Picture
PHP2Shell is a reminder that your attack surface includes code your vendors chose for you. Buyers rarely ask what open-source components sit inside an appliance, or how fast the vendor patches them. Add that question to your next renewal and security questionnaire: a vendor that can answer it quickly this week is one you can count on next time.
Not sure which of your vendors are exposed? Stackcurve advisors help IT leaders map vendor risk and press vendors for clear answers at no cost to you. Talk to an advisor →
Stackcurve is independent. No vendor pays for placement or editorial influence on this blog. Details are from the PHP project's October 21, 2026 release notes, CISA's October 26, 2026 KEV alert, and vendor advisories from Okta, Veeam and SonicWall (October 22, 2026).