PHP has published a security update to address a critical security issue known as PHP2Shell that may allow attackers to execute commands on any web server running PHP.
This was announced only yesterday (20 October 2026) and the security update was released at 3pm UK time today (21 October 2026). This was considered a critical vulnerability, rated 9.2 out of 10 under CVSS v4.0.
PHP is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user’s browser. PHP is also used in a range of other products. It’s estimated around 70% of websites globally use PHP (Wikipedia), so the potential impacts are widespread.
The security vulnerability could allow an attacker to trigger memory corruption and use this to achieve unauthenticated remote code execution. The fixes released today patch this – CVE-2026-109618 and CVE-2026-109619.
We monitored this security update closely. Most of our servers automatically started patching within under one hour of the security being released today and patches have been rolled out to our cloud platform this afternoon/evening. We have been monitoring to ensure these completed successfully.
21 October 2026
16:00 virtual servers patched
17:30 cloud platform patched for PHP 8.5, 8.4, 8.3, and 8.2
18:30 cloud platform fixes backported for older PHP versions
20:00 monitoring patches and fixes
21:00 custom servers patching and manual checks underway
22 October 2026
09:00 custom servers patching and manual checks continuing
12:00 custom servers patching and manual checks complete
If your services use our web security layer then they are also automatically protected from these vulnerabilities thanks to Cloudflare deploying protection extremely quickly. Although patching is of course still recommended and will take place. Please note that our web security layer is not included by default in our web hosting services. We recommend it for exactly these sorts of circumstances, but do not enforce that you use it. If you do not already have it, we recommend adding it – please contact us to do so.