PHP php2shell Vulnerability: What Hong Kong SMEs Must Do Now

On 20 October 2026, details of two PHP vulnerabilities leaked ahead of an embargo. The PHP team responded with an advisory: an emergency release on 21 October at 14:00 UTC (10:00 pm Hong Kong time) to fix two vulnerabilities rated CVSS 9.2.

Researchers call the pair "php2shell" — the implication being that a single request to a website could let an attacker run their own code on the server (remote code execution). For companies running PHP, this is not a routine "remember to update" item. It needs handling the same day.

What happened?

• Two identifiers: CVE-2026-109618 and CVE-2026-109619
• PHP rates both CVSS v4.0 9.2 (critical); watchTowr describes them as more severe still, and has confirmed both are real
• No mass exploitation had been observed at the time of publication
• Affected versions: reporting points to PHP 5.4 onwards (the official scope will be confirmed with the fix)

Why Hong Kong businesses should care

WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel all run on PHP. Many companies do not realise they have PHP at all: the website was built by an agency, the online shop is hosted, and control panels such as cPanel or Plesk bundle their own PHP. All of it is attack surface.

Security firm Sansec expects mass scanning within 15 minutes of the release. This kind of attack is automated; it does not choose its targets.

What you can do before the patch lands

Until the official fix is available, researchers suggest disabling one feature that is enabled by default:

• Add to php.ini: session.upload_progress.enabled = Off
• Also set session.use_strict_mode = 1
• Restart php-fpm or Apache so the change takes effect

To be clear: this is a mitigation, not a fix, and it is not guaranteed to block everything. Cloudflare and WAF rules can only stop part of it and are not a substitute for patching.

The real fix: patch as soon as it ships

Reporting suggests the fixed versions will be PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (confirm against the official advisory). PHP officially supports 8.2 and later, which means systems still on 8.1, 8.0 or 7.x will not receive an official patch.

If you still run older PHP, there are realistically three options: upgrade, migrate to a supported branch, or take the system off the public internet (VPN or internal network) until it is dealt with.

How to tell if you have been hit

The most common sign of exploitation is a PHP process spawning a shell. Look for:

• php-fpm, php-cgi, httpd or apache launching sh, bash, curl, wget or nc
• Unfamiliar .php files in the web root (webshells)
• New cron jobs, scheduled tasks or administrator accounts
• Unusual outbound connections, heavy scanning or unexpected logins

If you suspect a compromise: isolate the host, preserve web server and PHP logs, then investigate. Reinstalling is not the same as dealing with it.

A five-step checklist for SMEs

• 1. Inventory: list every system running PHP, including agency-built sites, online shops, NAS devices and control panels
• 2. Ask your host: ask today when they will patch, rather than waiting for a notice
• 3. Book a window: set aside time on the evening of 21 October to update and test
• 4. Back up first: site files and database, and confirm you can restore
• 5. Turn on monitoring: at minimum, someone should be watching for unexpected processes started by PHP

How we handle this

The first thing FROMDB does for a client is not "install a tool" — it is an inventory: which systems run PHP, who is responsible for updating them, and who responds when something happens. With this class of vulnerability, that is usually where the outcome is decided.

If you want a fast inventory of your PHP systems, or help applying this update, contact us today.

Sources: PHP official security advisory (2026-10-20), CERT-EU advisory 2026-018, watchTowr, Sansec, Huntress, BleepingComputer, Ars Technica. Affected and fixed versions are subject to the official PHP announcement; this article will be updated as details are confirmed.