Sources
Where this site gets its facts
Every version number, date and recommendation on this site comes from a primary source: the PHP project, a national cyber security agency, a Linux distribution or the platform's own documentation. These are the sources the pages rely on, grouped by who publishes them.
Last reviewed against each source below.
The PHP project
The authority on what is fixed, in which release, and which branches are still supported.
- php.net news: the 21 October 2026 security advisory and releases
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618), RCE via OOM corruption
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), RCE via stale global state
- Supported versions
- Unsupported branches
- Windows downloads
- Migrating from PHP 8.2 to 8.3 (one of the migration guides)
The researchers
The people who found and reported the flaws, and named them PHP2Shell.
National alerts
Government guidance on what to do, including when to take systems offline.
- NCSC (UK): Critical security issue affecting PHP, 21 October 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- CISA Known Exploited Vulnerabilities catalogue
- NCSC-NL alert, 21 October 2026
- NCSC-NL update on exploitation
- NCSC-NL inventory of products with PHP inside
- CERT-FR alert CERTFR-2026-ALE-014
- Canadian Centre for Cyber Security AL26-026
- FBI IC3 public service announcement, 23 October 2026
Linux distributions
Where fixed packages come from, often under older-looking version numbers.
Hosting panels and containers
The builds most hosted sites actually run.
Platforms
Which PHP versions each application supports.
- Adobe Commerce and Magento Open Source system requirements
- OpenMage requirements
- PrestaShop 9 system requirements
- WooCommerce server requirements
- WordPress requirements
- Drupal PHP requirements
- Drupal PSA-2026-10-20 on PHP2Shell
- Joomla technical requirements
- Laravel release notes and support policy
- Moodle releases
- Nextcloud 35 system requirements
Precautionary takedowns
Organisations that took their own sites offline, in their own words.
How the sources are used
Press coverage helps us notice what to check, but it is never the source of a fact here. Where organisations disagree, for example on severity scores, the page names each scorer. Each page cites its own sources in place and shows the date it was last checked. Changes to the site are recorded on the changelog.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.