Steven Lafortune
David GrandolfoOn October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities, tracked together as PHP2Shell. They can let someone who is not signed in run code on a server that uses PHP to answer web requests. Wiz Research, which reported the flaws with Calif and OpenAI, estimates that PHP powers about 70% of websites, including WordPress, Joomla, Drupal, and MediaWiki.
David Grandolfo, Defensive Security Coordinator, has a direct note for Devolutions customers: our SaaS products are not affected by PHP2Shell.
We understand that news about critical security vulnerabilities can raise concerns, especially when they affect technologies used by millions of websites worldwide. However, we have good news for Devolutions customers: our products and services are not affected by PHP2Shell.
The reason is simple: We do not use PHP in our products or infrastructure, which means these specific vulnerabilities do not impact Devolutions solutions.
Our security team continuously monitors emerging threats and evaluates their potential impact on our products and services. In this case, customers can rest assured that no additional updates, configuration changes, or actions are required on their part to address PHP2Shell.
While organizations using PHP should apply the available security updates as soon as possible, Devolutions customers can continue using our solutions with confidence.
What PHP2Shell is
The two flaws are CVE-2026-109618 and CVE-2026-109619. The PHP security advisory says both can allow unauthenticated remote code execution. They affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP security team says the risk is highest for mod_php, where a request can reach the flaw before the site’s own application code runs.
Google Cloud describes the official CVSS base score as 9.2 (Critical) for each flaw, and lists affected versions from PHP 5.4 through 8.5.11. Wiz reports the same range: nearly every PHP release of the last decade is affected by at least one of the issues. The bugs are in the PHP engine, so a careful application on an unpatched runtime is still exposed. Wiz also says the vulnerable code had been in PHP for more than a decade, and that AI tools made it practical to demonstrate the bugs and to help get them fixed.
BleepingComputer reports that Cloudflare was already seeing early attack attempts as the patches went out, and that temporary filtering is not a substitute for the update. The same report notes a warning from the UK National Cyber Security Centre: update systems that use PHP, or take them offline until they can be patched.
What to install
The PHP project says there are no complete mitigations. Updating is the only safe choice. Install one of these releases:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Linux distributions and long-term support vendors received the patches ahead of the public release, so check your vendor for updated packages. PHP 8.1 and older no longer receive updates from the PHP project. Some vendors are backporting fixes. If you are on those versions, contact your vendor or move to a supported release. For people who build from source, the PHP security team also published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1.
The advisory describes a few temporary measures for teams that cannot update today. PHP is explicit that those measures do not make an installation safe.
If you run PHP yourself
Devolutions products and services do not use PHP, so nothing changes on that side. This notice does not cover a PHP site you operate yourself: a public website, an intranet, or a content management system. If that is in your environment, treat it as a separate job and update PHP on the list above.