What are CVE-2026-109618 and CVE-2026-109619?

Two critical vulnerabilities in the PHP programming language itself, each with a CVSS 4.0 score of 9.2. The developers announced details and patches for 21 October 2026 at 4 pm German time (14:00 UTC). From the scores, the BSI concludes that exploitation requires neither authentication nor user interaction and that attackers could execute malicious code remotely on web servers running PHP applications. Reports call the flaws PHP2Shell.

Are Nextcloud, WordPress, Drupal and other applications affected?

Likely yes, because they run on PHP. The BSI lists WordPress, Drupal, TYPO3, Joomla, Magento, Nextcloud, pfSense and OPNsense as projects developed in PHP. Which configurations make the flaws actually exploitable has not been published before the advisory. The vulnerabilities are in PHP, not in the applications: what matters is the PHP runtime they run on.

Is updating Nextcloud or WordPress enough?

No. The flaws are in PHP. They are fixed by a PHP update of the system, the container or the appliance the application runs on, followed by a restart of the PHP processes. An application update does not replace that.

When does the patch arrive?

The security release is announced for Wednesday, 21 October 2026, 14:00 UTC, which is 4 pm German time. The PHP developers reserve the right to release earlier if details become public or exploitation appears. The advisory names affected and fixed versions with the release. Debian, Ubuntu and Red Hat publish their own advisories for their packages.

Is there a workaround?

At the time of publication the BSI names no workaround that reliably protects against exploitation. A web application firewall can help if detection rules exist for both flaws. The setting session.upload_progress.enabled mentioned in reports is considered ineffective according to heise online. If you cannot patch, disconnect the web server from the internet until the update or restrict access.

Is the flaw already being exploited?

As of 21 October the BSI knows of no confirmed exploitation, but of unconfirmed reports of existing exploits. It considers broad exploitation within a few hours of the patches appearing likely, because patches can be analysed quickly with AI-assisted tools.

Which software is not affected?

Applications whose core does not run on PHP cannot be attacked through PHP itself, for example GitLab (Ruby), Mattermost (Go), Odoo (Python) or Keycloak (Java). Companion services in the same stack that use PHP still need checking, such as database administration interfaces or webmail.

What applies to PHP 7.4, 8.0 and 8.1?

All PHP versions before 8.2 have reached end of support, and 8.2 receives security fixes only until 31 December 2026. Whether fixes appear for older branches is stated in the advisory and in the distributions' advisories. Distributions with their own maintenance sometimes ship fixes as backports with an unchanged version number. The BSI recommends migrating to a supported PHP version.

Do I have to update Docker containers too?

Yes. The BSI points out that applications running in Docker containers must be updated or rebuilt independently of the host if they use PHP. Updating host packages does not change the PHP version inside the container. Pull or rebuild the base image, recreate the container and then check the version inside it.

How do I check which PHP version is running?

On the server with php -v, and for web operation also with the PHP-FPM version, for example php-fpm8.3 -v. The BSI names php -v explicitly for comparison with the advisory. The command-line version can differ from the web server's if several PHP versions are installed. For backported packages the distribution's advisory decides, not the version number alone.

PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Which Software Is Affected and What to Do Now

Timo Wevelsiep21.10.2026

#PHP
#PHP2Shell
#CVE
#RCE
#Nextcloud
#WordPress
#Security
#CVEMonitoring

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

CVE monitoring and patch operations instead of finding out by accident - WZ-IT records where PHP runs in your environment, applies updates and then checks systems and containers. Book an intro call · Server audit · Nextcloud operations

Two vulnerabilities in PHP itself, each with a CVSS 4.0 score of 9.2, affect all PHP versions back to at least PHP 5 according to the BSI: CVE-2026-109618 and CVE-2026-109619, called PHP2Shell in reports. The PHP project publishes details and patches on 21 October 2026 at 4 pm German time. The BSI rates the situation 3 of 4 (orange): measures must be taken without delay.

Because the flaws sit in the runtime, every application running on PHP is likely affected: Nextcloud, WordPress, Drupal, TYPO3, Matomo, Moodle, Shopware and many more. This article lists the most common ones, explains why an application update is not enough and describes the steps for the moment the patch lands.

In brief
Status of the information
Which software is likely affected
Why an application update is not enough
What to do now
If you cannot patch immediately
Outdated PHP versions
Timeline
Common misconceptions
Status and methodology
Our approach at WZ-IT
Further guides

In brief

Question	Answer
Identifiers	CVE-2026-109618 and CVE-2026-109619, called PHP2Shell in reports
Severity	CVSS 4.0: 9.2 each, critical; BSI criticality 3 of 4 (orange)
Type	According to the BSI, remotely exploitable without authentication or user interaction, execution of malicious code on web servers with PHP applications
Affected	All known PHP versions back to at least PHP 5; the advisory names the details with the release
Patch	Announced for 21 October 2026, 4 pm German time (14:00 UTC), php.net
Exploitation	No confirmed cases, unconfirmed reports of exploits; the BSI expects broad exploitation within a few hours of the patches
Workaround	None reliably known; restrict access, WAF, disconnect the web server from the internet until patched
Measure	Update PHP on system, container and appliance, restart PHP processes, check the version

Status of the information

Status 21 October 2026, before the patches are published. Known are the PHP project's advance notice (two flaws, each CVSS 4.0 9.2, release on 21 October at 14:00 UTC), CERT-EU advisory 2026-018 and the BSI warning 2026-297981-1032. Affected configurations, the attack path and the fixed versions become public only with the release. This article will be updated with those details once the advisory is out.

Which software is likely affected

The PHP runtime is affected. Applications that run on it are therefore likely exposed. The BSI lists WordPress, Drupal, TYPO3, Joomla, Magento, Nextcloud, pfSense and OPNsense as projects developed in PHP. The table below classifies common open source applications. Whether a specific installation can be attacked depends on the details of the advisory.

Application	Use	Note for operators
Nextcloud	File storage, collaboration	PHP from the system or from the container image; pull the image again
WordPress	Websites, blogs, shops	Update PHP at the host or on the server
Drupal	Content management	PHP update on the web server
TYPO3	Content management	PHP update on the web server
Joomla	Content management	Named by the BSI; PHP update on the web server
Magento	Online shop	PHP update on the backend server or in the container
Shopware	Online shop	PHP update on the backend server or in the container
Matomo	Web analytics	PHP update on the web server
Moodle	Learning platform	PHP update on the web server
BookStack	Wiki	PHP update or rebuild the image
Snipe-IT	Asset management	PHP update or rebuild the image
GLPI	IT service management	PHP update on the web server
mailcow	Mail server suite	Web interface in PHP, update through the containers
pfSense and OPNsense	Firewalls	Web interface in PHP; wait for the vendors' firmware update, see OPNsense patch operations

That these applications are written in PHP is evident from the projects, for example Nextcloud, Matomo, Moodle, BookStack, Snipe-IT, GLPI and mailcow.

In addition, according to the BSI, PHP is also found in individual components of proprietary products. Companion services such as phpMyAdmin or webmail clients also run on PHP and belong in the inventory.

Why an application update is not enough

The flaws are in PHP, not in WordPress or Nextcloud. Three consequences follow:

The runtime decides. The package or image that provides PHP must be patched, and the PHP process must then restart so the new state is running. Updating the application itself changes nothing about that.
Every layer counts separately. The BSI points out that containers must be updated or rebuilt independently of the host and that appliance vendors must publish new firmware with patched PHP. One server can run several PHP versions and several containers at once.
Version numbers mislead with backports. Debian, Ubuntu and Red Hat often ship security fixes as backports with an unchanged major version. Comparing against the distribution's advisory (Debian, Ubuntu) is therefore more reliable than comparing version numbers alone.

What to do now

Before the release: clarify the inventory.

Record on which servers, in which containers and appliances PHP runs. php -v shows the command-line version; the web server may use a different one, for example php-fpm8.3 -v for PHP-FPM.
Determine which of these systems are reachable from the internet. Patch those first.
Clarify who may apply updates and restart services at release time. The BSI explicitly calls for keeping staff capacity ready.
Make sure current backups exist.

From the release: patch and verify.

Read the advisory on php.net: affected and fixed versions, possible measures.
Update system packages, for example on Debian or Ubuntu with apt update and apt list --upgradable | grep -i php, and compare the state with the distribution's advisory.
Containers: pull or rebuild the base image, recreate the container, check the version inside the container. A host update does not replace that.
Restart PHP-FPM and the web server if the package does not do it itself, and check the state again.
Appliances: apply the vendors' firmware updates as soon as they appear.

Afterwards: observe. The BSI recommends watching exposed PHP web servers more closely for anomalies. Binding indicators of attack are not available yet. As general hygiene, recently changed or new PHP files in web and upload directories and unusual requests in the web server logs can be checked.

If you cannot patch immediately

Restrict access. The BSI recommends keeping access to web applications restrictive and hardening components. Administration interfaces belong behind a VPN or IP restrictions.
Disconnect the web server from the internet. For systems that cannot be patched at short notice, the BSI names temporary disconnection until the patch. CERT-EU recommends the same for internet-facing applications.
WAF as a supplement. A web application firewall only prevents exploitation if detection rules for both flaws exist and are applied. It does not replace the patch.
No partial measure as a substitute. On session.upload_progress.enabled in php.ini the picture is contradictory: heise online describes the setting as ineffective according to current knowledge. It does not replace an update.

Outdated PHP versions

According to the BSI, all PHP versions before 8.2 have reached end of support, and 8.2 receives security updates only until the end of the year. According to php.net, the security branches run until 31 December 2027 for 8.3, 31 December 2028 for 8.4 and 31 December 2029 for 8.5. The latest regular releases from 24 September 2026 were 8.5.11, 8.4.26, 8.3.35 and 8.2.34.

Operators of applications on PHP 7.4, 8.0 or 8.1 should plan the migration to a supported branch. Whether fixes appear for older branches is stated in the PHP advisory and in the distributions' advisories. Anyone running a distribution with long-term maintenance may receive fixes as a backport.

Timeline

Date	Event
24 September 2026	Latest regular security releases: 8.5.11, 8.4.26, 8.3.35, 8.2.34
20 October 2026	PHP project announces a security release for two critical flaws, each CVSS 4.0 9.2
20 October 2026, 22:33 CEST	CERT-EU publishes advisory 2026-018
21 October 2026	BSI publishes warning and press release, criticality 3 of 4
21 October 2026, 4 pm CEST	Announced release with details, affected and fixed versions

Common misconceptions

"My application is up to date, so I am safe." No. The flaw is in PHP. An up-to-date WordPress or Nextcloud on unpatched PHP stays exposed.
"Host patched, container safe." No. Containers carry their own PHP and must be rebuilt.
"With session.upload_progress.enabled = 0 I am protected." Not according to heise online so far. The BSI names no reliable workaround.
"I can wait until Friday." The BSI considers broad exploitation within a few hours of the patches appearing likely.
"This only affects WordPress." No. Every application on PHP is affected, including administration interfaces, webmail and firewalls with a PHP web interface.

Status and methodology

Status 21 October 2026, before the patches are published. The information comes from the PHP project's advance notice, CERT-EU advisory 2026-018, the BSI warning 2026-297981-1032, the overview of supported PHP versions and the report by heise online. The assignment of applications is based on the programming language of the projects. Whether individual installations can be attacked is not established before the advisory, nor is the number of affected systems.

Our approach at WZ-IT

Inventory: We record where PHP runs in your environment: servers, containers, appliances and the version the web server actually uses.
Patching: We apply the PHP updates, rebuild container images, restart the services and verify the state against the advisory.
Checking: We examine web directories and logs for anomalies and rotate credentials if suspicion arises.
Operations: In managed operations, updates, CVE monitoring and backups are included; the server audit checks existing systems once.

Further guides

PHP update without finding out by accident: We record where PHP runs in your environment, apply the updates and check systems and containers. Book an intro call