Server takeover, no login
Anyone who reaches an unpatched PHP site can run code on the server, a path to data theft and ransomware.
Security advisory · patch released October 21, 2026
PHP2Shell: what it means for your business
Two critical flaws in PHP let attackers take over a server without logging in. Here is the risk, how to check your exposure, and how InnoBoon can help.
9.2CVSS v4.0 of 10
Critical severity
What happened
Two flaws. One urgent fix.
The PHP project disclosed and fixed two flaws in PHP core, the language behind a large share of the web.
2critical flaws in PHP core
9.2CVSS v4.0 severity score
0logins needed to exploit
- Fixed on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- No complete workaround exists. Updating is the only safe choice.
- CISA and CERT-EU have issued advisories urging immediate patching.
Sources: PHP.net release announcement (Oct 21, 2026); The PHP Foundation (Oct 21, 2026); CERT-EU Advisory 2026-018; CISA alert (Oct 21, 2026)
The risk
What it means for enterprises.
Attacks already at scale
Cloudflare saw thousands of exploit attempts before the announcement and millions within a day.
Old PHP stays exposed
PHP 8.1 and older get no regular release, only stopgap backports, and the flaws reportedly reach back to PHP 5.4.
PHP hides in many places
WordPress and Magento sites, internal portals, vendor appliances and container images that need rebuilding.
Sources: Cloudflare figures via Codeable (Oct 22, 2026); CERT-EU Advisory 2026-018
Self-check
Are you exposed?
If your team can’t answer any of these with confidence, treat your estate as exposed until checked.
Five questions for your team
- Do you know every app and server that runs PHP?
- Is anything internet-facing still below the fixed versions?
- Are any apps on PHP 8.1 or older?
- Are container images and vendor apps rebuilt or confirmed patched?
- Have logs been reviewed for unusual activity since October 20?
Patched versions
| Your branch | Update to |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | Backport only: upgrade |
PHP 8.2 stops getting security fixes on December 31, 2026, so plan moves to 8.4 or 8.5.
Sources: PHP.net release notes (Oct 21, 2026); Brandefense, PHP2Shell fixed versions (Oct 22, 2026)
How InnoBoon helps
From exposure check to staying patched.
Start with the exposure check, then take only the steps your estate needs.
Exposure check
48 hoursInventory PHP across sites, servers and containers, and flag internet-facing risk.
Patch and verify
About 1 weekApply fixed versions, rebuild container images and regression-test your apps.
Legacy upgrade
Sized to your codeMove apps on PHP 5.x to 8.1 up to 8.4 or 8.5, fixing code, plugins and frameworks.
Stay patched
Monthly retainerKeep every PHP app current, so the next alert is handled in hours.
Suspected compromise? We work alongside your security or incident-response provider.
A zero-cost exposure check
No costNo obligationResults in 48 hours
- A map of every PHP app, server and version you run
- A prioritized patch list for internet-facing systems
- An upgrade estimate for legacy applications
Found an issue? We show you how to fix it, and can do the work for you.