PHP Alert
Critical threat · PHP2ShellCVE-2026-109618 / CVE-2026-109619

Warning for website owners

PHP is under attack.
Your site could
be next.

If the security fixes have not been installed yet.

Two critical vulnerabilities could allow an attacker to run code on the server. An admin password may not be needed.

Cloudflare has already reported attack traffic. Waiting until your website stops loading means waiting for potential consequences.

View the situation ↓What to do now ↓

Sources: PHP advisory and Cloudflare report.

Do not wait for a breach notification. Check that the fixes are installed.Snapshot: reports from 21–22 October 2026
Situation dashboard

What is already known

A snapshot of verified reports.
Each assessment links to its source.

Attack attemptsObserved

Cloudflare reports attack traffic and attempts to bypass protection.

Cloudflare report ↗
Security fixesReleased

PHP updates and vendor packages are available. Check whether they are installed on your server.

Update information ↗

Attack attempts are not a count of successful breaches. This snapshot does not establish a global number of compromised websites.

Who needs particular attention

Which websites should be checked first?

Risk depends on the PHP build, installed fixes and server configuration.

No ongoing maintenance

Built years ago — then forgotten

The developer no longer maintains the website, there is no system administrator, and nobody knows who updates PHP. Prioritise checking this website.

Updates keep being postponed

Custom-built PHP websites

Especially when old code depends on an older PHP version, the original developer is unavailable, and updates are delayed because of compatibility concerns.

Highest technical risk identified by PHP

Apache with mod_php

The PHP team identifies this mode as the highest risk: exploitation may begin before the website’s own code runs.

Details from the PHP developers ↗
Patches not confirmed

Unsupported PHP branches

Standard upstream support has ended for PHP 8.1 and older branches. Confirm any special vendor-provided security fixes separately.

Responsibility is unclear

VPS without administration

Renting a VPS or dedicated server without a management service? Find out who installs security patches: renting the server alone does not establish that they are installed.

Only the CMS was updated

WordPress, Magento and other PHP systems

The CMS and plugins may be up to date while PHP remains unchanged. The server runtime itself needs to be checked.

Even a new website or PHP-FPM setup needs a patch check. A WAF can reduce risk, but it does not replace updating PHP.

Sources: PHP advisory, supported versions, Cloudflare guidance. Missing maintenance and delayed updates are reasons to prioritise a check, not evidence of a breach.

News and reported events

The threat has moved beyond an advisory

Reports selected by the editorial team.
Each card links to the original source.

Wikimedia / Wikitech
Precautionary restrictions

Wikimedia restricted some services to update PHP

The official report describes service shutdowns and a phased recovery. This was a precautionary measure, not proof of a breach. The status is from the report dated 22 October.

Wikimedia report ↗
Cloudflare
Attack attempts

Attackers are already trying to bypass protection

Cloudflare observes attack traffic and modified requests intended to evade its rules. The company recommends updating PHP even when WAF protection is enabled.

Cloudflare’s original report ↗
PHP.net
Critical vulnerabilities

PHP released emergency security fixes

Two CVEs could allow unauthenticated code execution. The PHP team urges users to install the fixes; Apache with mod_php is identified as the highest-risk setup.

Official PHP advisory ↗
Ubuntu Security
Vendor patches

A patched build may retain an older version number

Ubuntu released updated packages. Assess the server using its build and vendor patches, not just the PHP version number.

Ubuntu advisory ↗

Snapshot of reports from 21–22 October 2026. Each card is dated by the source’s publication or update. The information reflects that snapshot.

Why website owners should care

The problem goes deeper
than a password
or a plugin.

PHP is the server runtime behind many web applications. The fix must reach the PHP installation that actually serves your website.

  • Updating WordPress alone is not enough

    Updating the CMS and plugins does not itself apply PHP security fixes.

  • A firewall does not remove the need to update

    A WAF reduces exposure to known attack methods. The PHP patch is still required.

  • The risk may not be visible from outside

    A website address alone often cannot reveal the PHP build or installed fixes. An undisclosed version does not mean the site is secure.

What to do now

Share this information with your administrator or hosting provider

01 / CLARIFY

Who updates PHP?

Contact your administrator or hosting provider. Find out who is responsible for your website’s server runtime.

02 / CONFIRM

Are both CVEs fixed?

Ask for confirmation that the PHP build serving your website includes the fixes, taking vendor patches into account.

03 / CHECK

Have the fixes taken effect?

Ask the administrator to check the running PHP processes and the website’s main functions after installing the patches.

Ready-to-send message

Please check whether CVE-2026-109618 and CVE-2026-109619 are fixed in the PHP installation serving our website. Confirm the installed build, including vendor patches, and that the fixes have taken effect in the running PHP processes.

PHP 8.2.35PHP 8.3.36PHP 8.4.27PHP 8.5.12

Patched releases listed in the PHP advisory of 21 October. For distribution packages, verify vendor patches; a version number alone is not conclusive.

Clear answers without technical jargon

Frequently asked questions

The website works. Does that mean it is secure?

No. A vulnerable website can load normally. The installed PHP build and applied security fixes need to be checked.

The browser shows an HTTPS padlock. Is that not enough?

HTTPS protects the connection to the website. It does not, by itself, confirm that the server software has been patched.

Can you assess the risk from a website address alone?

Sometimes there are useful clues, but a reliable assessment often needs information from the administrator or hosting provider. An undisclosed version is not evidence that there is no risk.

Does a service outage mean it was hacked?

Not necessarily. An operator may restrict a service as a precaution while installing fixes. A confirmed breach is a separate fact.

If you cannot investigate it yourself

We can help establish
whether there is a risk.

We will review the available information about your website, clarify what to check with your hosting provider and help assess its PHP status. If a risk is confirmed, we can carry out remediation remotely. With your authorisation, we can contact your hosting provider, request patch information and help coordinate an update.

5 000 ₸

Risk assessment

Per website. We will check the available information and explain what we could confirm.

up to 40 000 ₸

Remediation if a risk is found

Per website, remotely. We will agree the required work before starting.

If the website address does not provide enough information, details from the administrator or hosting provider will be needed. Payment arrangements are agreed before work starts.

Discuss a risk assessment

Risk assessment — 5 000 ₸ per website.

Send your website address and briefly describe the situation. With your authorisation, we can contact your hosting provider to clarify the PHP status.

Message us on WhatsApp

Email: info@kogut.academy
Do not send passwords with your initial enquiry.

Kogut.academy · Almaty

Contacts

Need help checking your website? Message us on WhatsApp or by email. For your initial enquiry, a website address and a description of the situation are enough.

Kogut.academy contacts · contact page on the main website ↗