On 20 October 2026 the PHP team announced an emergency release for two critical security flaws. Within hours the event had a name: PHPocalypse. Government agencies in several countries took websites offline, Laravel paused deployments in its cloud, and Cloudflare rolled out protective rules for all customers.
The reason for the alarm: the bugs are not in a plugin or framework but in PHP itself. PHP powers a large share of the web, including WordPress, Shopware, Magento, Drupal, Joomla, Laravel and countless custom applications.
What happened?
Two vulnerabilities, together also called "PHP2Shell":
- CVE-2026-109618: remote code execution via memory corruption in out-of-memory situations
- CVE-2026-109619: remote code execution via stale global state
Both are rated critical at CVSS 9.2. An attacker needs no login and no account. The flaws trigger before any application code runs, so authentication or security checks inside your application do not help.
On top of that, the embargo leaked about a day early, so attackers had details before patches were available.
Who is affected?
According to the PHP project, any PHP installation that serves web requests is at risk, whether through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. Risk is highest with mod_php. Wiz Research reports that affected versions go back to PHP 5.4.
In short: if your website, shop or customer portal runs on PHP, you are exposed until it is patched.
Patched versions
On 21 October 2026 at 14:00 UTC the PHP team released:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older receive no official release. The security team published minimal backports for 7.4, 8.0 and 8.1, but you have to apply them yourself. If you still run PHP 7.x or 8.0/8.1, now is the time to upgrade to a supported version. Estimates suggest roughly a third of all WordPress sites run an unsupported PHP version.
What does not help
- php.ini tweaks: according to a PHP release manager, no setting stops the attacks, including disabling
session.upload_progress. - Community workarounds: Datadog stresses that only the official patch protects you.
- Relying on a WAF alone: Cloudflare deployed rules against known attack patterns and is already seeing attackers modify their payloads. A WAF also only helps if your origin server blocks traffic that bypasses the CDN.
What to do now
- Take inventory: which servers, containers and hosting plans run PHP, and which version? Include staging systems, old microsites and internal tools.
- Patch: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On managed hosting, ask your provider whether and when the update was applied.
- Go offline if needed: CERT-EU advises taking internet-facing PHP applications offline if you cannot patch immediately.
- Look for traces: since details were public before the patch, check logs, new or modified files and unknown admin accounts.
- Deal with legacy: migrate systems on PHP 8.1 or older to a supported version. The next flaw will come.
We check your systems
Not sure which PHP version your servers run, or whether your host has patched yet? We handle it for you: we check your websites, shops and servers for the PHPocalypse flaws, apply the updates and look for signs of compromise.