Critical vulnerability in PHP

PHP2Shell: we are shielding your server and patching it.

Two leaks in PHP itself give attackers access to your server without logging in. The details were already online before the patch was available. We take over the entire process: inventory, shielding, patching, and checking if anyone has already gained access.

CVE-2026-109618CVE-2026-109619CVSS 9.2 / 10

Have it checked today Call 085 30 350 45

Status for managed clients

No action required

Temporary measures implemented
PHP versions per server mapped out
Roll out patch as soon as PHP releases it
Review logs for traces of abuse

Technical explanation on our blog →

Why this is different

The leak is located before your application.

PHP processes a request before WordPress, Laravel, or your own code executes a single line. Updating your CMS or installing a security plugin therefore does not solve this.

Attackerrequest without login

Web servernginx · Apache · LiteSpeedHere we block

PHPmultipart processingHere is the leak

WordPress · Laravel · pluginscomes too late

Are you vulnerable?

Assume you are if you use PHP. What needs to be done depends on your version.

Receiving a patchPHP 8.2 – 8.5

Shield now, update immediately as soon as the update is released.

No patch expectedPHP 8.1 and older

Keep measures in place and upgrade as soon as possible. We will do that with you.

UnknownDon’t know?

php -v says nothing about your website. We will find out which PHP version actually serves your sites.

Our approach

Four steps, from shielding to final check.

1
Inventory
Every server, site, staging environment, container, and management tool with PHP. Including which version and which php.ini is actually running.
2
Shielding
Session upload progress disabled and multipart requests blocked on the web server, also directly on the IP. Tested with curl.
3
Patching
Every PHP version updated, including Docker images. PHP-FPM, workers, and queues restarted so that nothing continues to run on the old binary.
4
Checking
Logs, modified files, cron jobs, SSH keys, and new administrators reviewed. Afterward, we remove the temporary blockade.

Common mistakes

What does NOT help.

Anything that only runs after PHP has read the request comes too late. These measures give a false sense of security.

~~Updating WordPress or plugins~~The leak is in PHP, not in your CMS.
~~Wordfence or another security plugin~~Only runs after PHP has already processed the request.
~~file_uploads = Off~~PHP still reads the request.
~~disable_functions~~Does not affect the error in processing.
~~Only a WAF or Cloudflare~~Does not help if your server is also directly accessible via its IP.
~~Choosing a different PHP version in your panel~~Says nothing about whether that build is patched.

How we help you.

Managed client

You don’t have to do anything

The temporary measures are already in place. We patch as soon as the update is available and then check the logs. You will hear from us if we find anything.

Included in your management package

No management contract

We will take a look today

An engineer will map out your PHP, shield your server, and patch it. Also with your own provider, in Docker, or behind a hosting panel.

Request help 085 30 350 45

Questions about PHP2Shell.

Direct line to an engineer 085 30 350 45 Even if you are not yet a customer

What exactly is PHP2Shell?

The nickname for two vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, both with a score of 9.2 out of 10. An attacker can use them to execute their own code on your server without logging in. Read the full explanation →

My site does not have an upload form. Am I safe?

No. PHP processes the request before your application runs, so even a site without an upload form is vulnerable.

Will I notice anything from the temporary measures?

As long as the blockade is in place, file uploads will not work, such as the WordPress media library and forms with attachments. Normal pages, logging in, and APIs will work as usual. After the patch, we will remove the blockade.

I am on shared hosting. Now what?

Ask your hoster which patched PHP build serves your domain. If you don’t want to figure it out yourself, or if you want to leave your hoster, we can help you.

How do I know if anyone has already gained access?

You can tell by the logs, modified files, new cron jobs, SSH keys, and management accounts. We will check that for you. If we find anything, we will isolate the server and help with recovery.

I am running PHP 8.1 or older

No patch is expected for that. We will keep the measures in place and plan an upgrade to a supported version together.

Since 2008

Companies that run on us.

For over 15 years, we have been providing secure and reliable IT to small and medium-sized businesses. For a fixed monthly fee and with short contracts.