PHP's Worst Week of 2026: Two Emergency Patches, Then a Third Unpatched Flaw
By UVIDSTUDIO · October 26, 2026 · 8 min read · Cybersecurity
PHP shipped emergency fixes for two critical, unauthenticated remote-code-execution bugs nicknamed "PHP2Shell" on October 21 — then disclosed a third RCE two days later with no patch available yet. Here's what actually happened, who's exposed, and what to do before the real fix ships.
If your site runs on PHP — and a large share of the small-business web does, whether you know it or not — this is the week to actually read a security advisory instead of skimming the headline. On October 21, 2026, the PHP Foundation shipped emergency, out-of-cycle patches for two critical vulnerabilities researchers are calling PHP2Shell. Two days later, on October 23, the same security team disclosed a third, separate remote-code-execution flaw — and this one shipped with mitigation advice instead of a fix, because no patched version exists yet. Three unauthenticated RCE bugs in one language runtime inside a single week is not routine, and the timing matters more than usual: PHP powers an enormous share of the web's small-business sites, almost always through shared hosting nobody is actively watching.
What happened
PHP2Shell is the pair tracked as CVE-2026-109618 and CVE-2026-109619: unauthenticated remote-code-execution flaws, meaning an attacker needs no password, no login, and no prior access to run their own code on a vulnerable server. The advisory covers the common ways PHP actually runs in production — PHP-FPM, Apache paired with mod_php, php-cgi, FrankenPHP, and LiteSpeed setups. The PHP team fixed both issues in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and — in an unusual move given how severe the bugs are — also published minimal source patches for the older, no-longer-officially-supported 7.4, 8.0, and 8.1 branches (BleepingComputer).
Two days after that patch shipped, PHP disclosed CVE-2026-115560, a separate unauthenticated RCE with no fixed version yet available. It's narrower than PHP2Shell — it only bites an application that switches its session.serialize_handler to php_binary or php_serialize at runtime via ini_set() before calling session_start(), with session.upload_progress still turned on — but narrow doesn't mean rare; plenty of CMS platforms and frameworks touch session handling in exactly this way. Until a real patch lands, PHP's own recommended mitigation is to set session.upload_progress.enabled=0 in php.ini or your FPM pool configuration — not via ini_set() or a .user.ini file, since those apply too late in the request lifecycle to help (The Hacker News).
Why it matters for small businesses
Unauthenticated RCE is the most dangerous class of bug there is precisely because it skips every lock you've put on the front door — there's no password to steal, no account to phish, just a vulnerable server waiting to be found by the automated scanners that probe the internet constantly for exactly this kind of opening. And the exposure here is wide: most budget and mid-tier shared hosting runs PHP under one of the affected configurations, which means WordPress, many ecommerce platforms, and countless custom-built small-business and nonprofit sites are sitting somewhere on this list whether anyone who manages the site realizes it or not. We've written before about how a single WordPress exploit chain can turn into a Google Safe Browsing blocklist entry and months of lost SEO rankings overnight — a runtime-level PHP flaw is the same risk one layer deeper in the stack, below the CMS you can see and patch yourself.
This is also a good moment to ask a question most small businesses can't actually answer: do you even know what PHP version your host is running, or whether your hosting provider has already applied this patch on your behalf? If the honest answer is "I'm not sure," that uncertainty is itself the finding — it means nobody currently owns the question, which is exactly the gap a cyber footprint audit is built to close.
What to do this week
You don't need to be a developer to act on this, but you do need to actually check rather than assume your host already handled it. 1. Ask your host directly whether your server or shared-hosting environment has been patched to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or the relevant 7.4/8.0/8.1 source patch) — a good host will answer this in one email; a vague answer is itself a red flag. 2. If you manage your own server or VPS, apply the update now rather than waiting for a scheduled maintenance window; this is the kind of fix that belongs in the "today" column, not "next sprint." 3. Set the mitigation for CVE-2026-115560 — session.upload_progress.enabled=0 in php.ini or your FPM pool config — as a precaution while PHP finalizes a real patch, even if you're not certain your code touches session serialization directly. 4. Watch for the follow-up advisory; PHP has said a full fix for the third flaw will ship with an upcoming release, and that's worth tracking rather than assuming it's already closed. 5. Fold this into a standing habit, not a one-time scramble — the businesses that get hurt by weeks like this one are never the ones running old software on purpose, they're the ones who never built a routine for patching known vulnerabilities fast when they're disclosed.
None of this is exotic engineering — it's the unglamorous, routine maintenance that quietly decides whether a bad week in the PHP ecosystem becomes your bad week too. If you're a small business or nonprofit in Jersey City or anywhere in the NYC metro and you're not sure who's actually watching your hosting stack for weeks exactly like this one, that's precisely the gap our cybersecurity and web design teams close — patching, monitoring, and maintenance built into how your site is run, not something you find out was missing after the fact.