On October 20, 2026, the PHP team announced a critical security update. A day later, on October 21, the details and patches followed. It concerns PHP2Shell: two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow an attacker to execute code remotely on a web server without logging in. Both received a CVSS score of 9.2 (critical). According to researchers, versions of PHP 5.4 through PHP 8 are affected.
PHP runs on a large part of the internet, including WordPress and numerous web applications.
What is PHP2Shell?
PHP2Shell consists of errors in the memory management of the PHP engine itself. An attacker can cause code to be executed on the server through a regular web request. In the worst case, this means complete control over the web server, access to data, and a foothold into the rest of the network.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For older versions (7.4 through 8.1), there are no official releases, but minimal backports from the PHP security team do exist.
Our response at XVE
At XVE, we were on top of it from the start. As soon as the PHP team announced the critical release, and thus before any details or patch were available, our engineers mapped the impact on our entire server infrastructure and took mitigating measures.
The result: our service was never interrupted.
Even in the period without an official patch, all our systems remained operational while the critical components were shielded and restricted.
When the official patch was released on October 21, we were ready.
Within half an hour, our entire server infrastructure was patched and fully operational again.
Here's how we handled it concretely:
1. Quick detection and inventory
Immediately after the announcement, we mapped where PHP runs in our environment. Which servers, which versions, and which applications are publicly accessible. This way, we knew within a short time exactly which systems had priority and where the risk was greatest.
2. Mitigation without downtime
While waiting for the official patch, we restricted and shielded the critical components. We limited the exposure of vulnerable systems without shutting down our services. Customers and employees could continue working normally while the attack surface was minimized.
3. Controlled patch rollout
Because the preparation had already been done, we could roll out the official patch immediately as soon as it was available. Within half an hour, our entire server infrastructure was updated. After the rollout, we verified that all systems were effectively running a secure version and all services were functioning correctly.
4. Heightened vigilance
Even after patching, we remain alert. We monitor our systems extra for suspicious activity and signs of abuse. This way, we are certain that nothing went wrong even in the period before the patch.
What does this mean for our customers?
From XVE.IT, XVE.Agency, and XVE.Dev, we actively monitor this for the environments and websites we manage.
Do you have a website, web shop, or application on PHP and are unsure if you are secure?
Feel free to contact us. We would be happy to check it for you.
Our advice
Update PHP as quickly as possible to a patched version.
Are you still running an outdated PHP version? Then plan an upgrade.
Check your servers for signs of abuse.
At XVE, we take security seriously.
Quick response, proactive protection, and clear communication: that's how we keep our and your environment safe.
Our team is ready for you.
Luka Ver Eecke and Bram Vanden Broeck
