Every PHP install that serves web pages.

PHP2Shell

Two flaws in PHP itself let a stranger run their own code on a web server without logging in.

If your site runs on PHP, a stranger could run their own code on your server until PHP is updated.

php.net names mod_php on Apache as the highest risk.

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

“Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities.”

Sophos, correction of October 22, 21:21 UTC

The one-time patch check, $395 per site: where we have access we patch PHP, restart it and confirm the fix from a live page; where only your host can, we ask them in writing.

CVE-2026-109618, CVE-2026-109619 Last checked

Sources