# Patch now for php2shell (critical PHP RCE vulnerabilities)

Canonical: https://brew.new/templates/ox/patch-now-for-php2shell-critical-php-rce-vulnerabilities

Brand: ox.security
Category: content

![Preview of Patch now for php2shell (critical PHP RCE vulnerabilities)](https://cdn.brew.new/email-preview-8036952b2cfef128-tracking_r57nnya0n9g8btfv8v6c4hbkns8gqb3t-1792599696050.png)

## Email content

Hi there,

Following up on our earlier note: PHP has released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities collectively dubbed "php2shell." Left unpatched, they allow unauthenticated attackers to gain full code execution on virtually any publicly accessible PHP instance.

Who is at risk

This affects every PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the risk highest for mod_php. Because PHP runs WordPress, Magento, Drupal, Laravel and countless custom apps, the exposure is broad.

What to do

1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.

2. If you run PHP 8.1 or older, contact your vendor about backported fixes or upgrade to a supported version.

3. If you can't patch right away, restrict or remove public access to unpatched instances. Interim mitigations from PHP reduce exposure but don't make an installation safe.

4. Don't run unverified PoCs, detection scripts or third-party patches circulating online. Rely only on official PHP and vendor sources.

How OX can help

OX can find every PHP runtime across your container images and cloud workloads, including those deployed outside standard processes, so you know exactly what needs patching.

Our research team's full breakdown, including an independent technical analysis, is on our blog:

Learn more

Best,

The OX Security Team

LinkedIn

X

YouTube

Instagram

OX logo navy

OX Security, 488 Madison Ave., New York, New York 10022, USA

Unsubscribe

Manage preferences

[Open and remix this design](https://brew.new/templates/ox/patch-now-for-php2shell-critical-php-rce-vulnerabilities)

[Browse email designs](https://brew.new/browse/templates)