PHP2Shell Patch Released: Secure Versions and How to Update
Jakarta, CNBC Indonesia — The PHP development team has officially released an emergency security update to close a critical vulnerability known as PHP2Shell. The flaw could allow hackers to run malicious code remotely without a password or account, so website administrators have been urged to install the fix immediately, CNBC Indonesia reported on Thursday (22 October 2026).
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have a severity rating of 9.2 out of 10. They enable attackers to target servers directly, even before the web page code is executed. Apache mod_php configurations are considered most at risk, as a simple unauthorised request could trigger an attack.
“There are no other preventive measures that are completely safe. Updating is the only option,” the PHP development team said in an official statement.
Patched PHP versions
Updates have been released for four major branches. Ensure your system is running at least one of the following versions:
PHP 8.5.12 or later
PHP 8.4.27 or later
PHP 8.3.36 or later
PHP 8.2.35 or later
PHP 8.1 and earlier versions no longer receive regular updates. However, source-code fixes have been provided for PHP 7.4, 8.0 and 8.1 to assist users who build their own systems. Users are advised to plan a migration to a supported version as soon as possible. Support for PHP 8.2 is scheduled to end on 31 December 2026.
How to check and update
Check the version: If you use a control panel such as cPanel, look in MultiPHP Manager or Select PHP Version.
If you manage the server yourself, run
php -vin the terminal. Bear in mind that the version shown in the terminal may differ from the one used by the website.Back up first: Save copies of your files and database before making changes.
Check compatibility: Make sure your application, content management system, themes and plugins are compatible with the PHP version you plan to install.
Install the update: Use your hosting provider’s control panel or the operating system’s package manager. Restart the web server if necessary.
Test the site: Open its pages to ensure all functions are working normally after the update.
Users who do not manage their own servers should contact their hosting provider. Ask whether the fix has been applied and which version is active. If the control panel allows you to select a version, choose a patched release after checking that it is compatible with your website.
A firewall or traffic-filtering system may reduce the risk, but cannot replace the official update. The only guaranteed way to secure the software is to install the update directly.