Security ·
PHP2Shell: how Script responded to the latest critical PHP vulnerability
On 21 October 2026, the PHP project shipped emergency patches for two critical flaws that security researchers have nicknamed PHP2Shell. If your website runs on PHP — and most WordPress, WooCommerce, Laravel and custom business sites do — this one mattered. Within hours of the announcement, the Script team was patching client servers.
Here’s what happened, what we did, and what (if anything) you need to do.
What happened
PHP2Shell is two separate bugs in PHP itself, not in any one plugin or app. Both let an attacker run their own code on a web server without logging in. Each is rated 9.2 out of 10 (critical).
- CVE-2026-109618: a crafted upload request can push PHP into running out of memory and corrupt it.
- CVE-2026-109619: a “use-after-free” bug where leftover data from one request can be abused by the next.
The flaws reach back to PHP 5.4, so almost every PHP server that serves web pages is exposed — PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP alike. The fix is to update to one of these versions or newer:
| PHP branch | Patched version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older are out of regular support; only limited backported fixes exist. Public proof-of-concept exploits appeared within a day. Rapid7 says none is yet broadly reliable, but expects real attacks to follow, and CISA urged immediate patching.
How Bahrain responded
Bahrain’s National Cyber Security Center moved on the same day PHP released its fix. The Bahrain National CERT issued advisory NCSC-TAD-2610-002, “Critical PHP Vulnerabilities – Immediate Preparation Required”, on 21 October 2026. It told organisations to:
- Find every PHP deployment, including sites run by third-party hosts.
- Patch as soon as fixes land, internet-facing systems first.
- Agree with app owners and providers who is responsible for updating PHP.
- Restrict or isolate exposed apps if they can’t be patched quickly.
- Watch logs and report suspected compromises to Bahrain National CERT.
How Script responded
We treated PHP2Shell as an emergency from the moment the advisory dropped. Our response followed the same steps the NCSC recommended:
- Assess. We reviewed the PHP and NCSC advisories and identified every PHP-based system we manage for our clients.
- Protect. Where an upgrade needed a maintenance window, we applied interim hardening first: disabling session upload progress and tightening request-size limits.
- Patch. We upgraded PHP on client servers to the fixed releases.
- Verify. We reviewed server logs for signs of exploitation attempts.
- Communicate. We kept affected clients informed throughout, so no one was left wondering whether their systems were safe.
What you need to do
If Script manages your hosting or maintenance: nothing. Your servers have been patched and we’ll contact you directly if anything needs your attention.
If your site is hosted elsewhere:
- Ask your host which PHP version your site runs.
- Make sure it is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
- If you’re on PHP 8.1 or older, plan an upgrade — those versions no longer get full security fixes.
- Not sure? Get in touch and we’ll check for you.
Security is part of the service
Vulnerabilities like PHP2Shell don’t wait for business hours. That’s why we track security advisories daily, keep client servers on supported PHP versions, and patch fast when it counts. If you want a team that watches your website’s security so you don’t have to, contact Script Solutions.