{
    "success": true,
    "data": {
        "id": 2049632,
        "msgid": "php2shell-patch-released-secure-versions-and-how-to-update-1792641073",
        "date": "2026-10-22 10:05:00",
        "title": "PHP2Shell Patch Released: Secure Versions and How to Update",
        "author": "",
        "source": "CNBC",
        "tags": "",
        "topic": "Technology",
        "summary": "PHP\u2019s development team has issued an emergency security update for PHP2Shell, a critical vulnerability rated 9.2 out of 10 that could allow unauthenticated remote code execution. Website administrators should upgrade to a patched release immediately; firewalls and traffic filtering are not substitutes for updating the software.",
        "content": "<p>Jakarta, CNBC Indonesia \u2014 The PHP development team has officially\nreleased an emergency security update to close a critical vulnerability\nknown as PHP2Shell. The flaw could allow hackers to run malicious code\nremotely without a password or account, so website administrators have\nbeen urged to install the fix immediately, CNBC Indonesia reported on\nThursday (22 October 2026).<\/p>\n<p>The two vulnerabilities, identified as CVE-2026-109618 and\nCVE-2026-109619, have a severity rating of 9.2 out of 10. They enable\nattackers to target servers directly, even before the web page code is\nexecuted. Apache mod_php configurations are considered most at risk, as\na simple unauthorised request could trigger an attack.<\/p>\n<p>\u201cThere are no other preventive measures that are completely safe.\nUpdating is the only option,\u201d the PHP development team said in an\nofficial statement.<\/p>\n<p><strong>Patched PHP versions<\/strong><\/p>\n<p>Updates have been released for four major branches. Ensure your\nsystem is running at least one of the following versions:<\/p>\n<ul>\n<li><p>PHP 8.5.12 or later<\/p><\/li>\n<li><p>PHP 8.4.27 or later<\/p><\/li>\n<li><p>PHP 8.3.36 or later<\/p><\/li>\n<li><p>PHP 8.2.35 or later<\/p><\/li>\n<\/ul>\n<p>PHP 8.1 and earlier versions no longer receive regular updates.\nHowever, source-code fixes have been provided for PHP 7.4, 8.0 and 8.1\nto assist users who build their own systems. Users are advised to plan a\nmigration to a supported version as soon as possible. Support for PHP\n8.2 is scheduled to end on 31 December 2026.<\/p>\n<p><strong>How to check and update<\/strong><\/p>\n<ul>\n<li><p><strong>Check the version:<\/strong> If you use a control panel\nsuch as cPanel, look in MultiPHP Manager or Select PHP Version.<\/p><\/li>\n<li><p>If you manage the server yourself, run <code>php -v<\/code> in the\nterminal. Bear in mind that the version shown in the terminal may differ\nfrom the one used by the website.<\/p><\/li>\n<li><p><strong>Back up first:<\/strong> Save copies of your files and\ndatabase before making changes.<\/p><\/li>\n<li><p><strong>Check compatibility:<\/strong> Make sure your application,\ncontent management system, themes and plugins are compatible with the\nPHP version you plan to install.<\/p><\/li>\n<li><p><strong>Install the update:<\/strong> Use your hosting provider\u2019s\ncontrol panel or the operating system\u2019s package manager. Restart the web\nserver if necessary.<\/p><\/li>\n<li><p><strong>Test the site:<\/strong> Open its pages to ensure all\nfunctions are working normally after the update.<\/p><\/li>\n<\/ul>\n<p>Users who do not manage their own servers should contact their\nhosting provider. Ask whether the fix has been applied and which version\nis active. If the control panel allows you to select a version, choose a\npatched release after checking that it is compatible with your\nwebsite.<\/p>\n<p>A firewall or traffic-filtering system may reduce the risk, but\ncannot replace the official update. The only guaranteed way to secure\nthe software is to install the update directly.<\/p>",
        "url": "https:\/\/jawawa.id\/newsitem\/php2shell-patch-released-secure-versions-and-how-to-update-1792641073",
        "image": ""
    },
    "sponsor": "Okusi Associates",
    "sponsor_url": "https:\/\/okusiassociates.com"
}