Current PHP security alerts
The most serious current PHP vulnerability is PHP2Shell: two critical flaws that can let an attacker with no login run code on a web server. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and CISA lists both as exploited. If you run PHP, update now.
Last reviewed against php.net, the NCSC and CISA.
The board
Newest first. Each entry links to the detail, taken from the PHP project's own advisories.
Two flaws in PHP itself that can let an attacker with no login run code on a web server. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On CISA's Known Exploited Vulnerabilities catalogue since 26 October 2026.
Fixed versions and what to doA follow-up linked to CVE-2026-109619, reachable only with an unusual session configuration. php.net suggests turning session upload progress off until its next bugfix release.
Who it affectsRebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) update the bundled Brotli library. The PHP version numbers themselves are unchanged.
When it mattersIf you run PHP
1
From your hosting panel, WordPress Site Health or the command line.
2
Patch, mitigate, or restrict access until it is fixed.
3
On WordPress hosting, or on a server you run yourself.
4
Patching closes the hole; it removes nothing already planted.
Running WordPress? Updating WordPress does not update PHP. How to update PHP in WordPress covers the control panel route most hosts use.
Coming up
After that date PHP 8.2 gets no more security fixes, including for whatever is found next. A site patched to 8.2.35 this month is fixed for PHP2Shell, but has weeks, not years, before it needs to move again.
PHP end of life dates and your optionsAbout this site
The CyPro team maintains this site. Version numbers, dates and mitigations come from the PHP project, the NCSC and CISA, and every page shows when it was last checked against them. Where sources disagree, the page says so and names each one.
Who we are and how pages are kept currentQuick answers
The most serious current PHP vulnerability is PHP2Shell, two critical flaws tracked as CVE-2026-109618 and CVE-2026-109619 and fixed on 21 October 2026. php.net says they affect all PHP installations serving web requests, and CISA has added both to its Known Exploited Vulnerabilities catalogue.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and later releases on those branches. PHP 8.1 and older get no fix from the PHP project.
Yes, on a supported branch kept up to date. Serious flaws turn up in every widely used platform; what separates a safe PHP site from an exposed one is whether it runs a supported version and gets security releases applied promptly. PHP 8.2 reaches end of life on 31 December 2026, so sites on 8.2 should plan their move now.
CyPro Consulting Ltd, the London cyber security consultancy, runs PHP Vulnerability. Every fact on the site is taken from the PHP project, the NCSC or CISA, and each page shows the date it was last checked against them.
How CyPro can help
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Our consultants put a web application firewall in front of the site, isolate the server from the rest of your network and lock down admin access and data export.
More on cypro.co.uk
Our SOC analysts watch your servers day and night for the signs of exploitation: PHP workers starting shells, new outbound connections, logins that do not fit.
More on cypro.co.uk
A focused test of the site and the controls around it, so you know the firewall, segmentation and monitoring hold before an attacker finds out for you.
More on cypro.co.uk
A senior security lead who advises the board on whether to patch, mitigate or accept the risk, puts numbers on each option and owns the decision record.
More on cypro.co.uk If a site may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you back online safely.
More on cypro.co.uk
Find every internet-facing PHP server you run, including the forgotten ones, and see which are still on a vulnerable build.
See the PHP exposure scan
Know your exposure
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.
