Current PHP security alerts
The most serious current PHP vulnerability is PHP2Shell: two critical flaws that can let an attacker with no login run code on a web server. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and CISA lists both as exploited. If you run PHP, update now.
Last reviewed against php.net, the NCSC and CISA.
The board
Newest first. Each entry links to the detail, taken from the PHP project's own advisories.
Two flaws in PHP itself that can let an attacker with no login run code on a web server. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On CISA's Known Exploited Vulnerabilities catalogue since 26 October 2026.
Fixed versions and what to doA follow-up linked to CVE-2026-109619, reachable only with an unusual session configuration. php.net suggests turning session upload progress off until its next bugfix release.
Who it affectsRebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) update the bundled Brotli library. The PHP version numbers themselves are unchanged.
When it mattersIf you run PHP
1
From your hosting panel, WordPress Site Health or the command line.
2
Patch, mitigate, or restrict access until it is fixed.
3
On WordPress hosting, or on a server you run yourself.
4
Patching closes the hole; it removes nothing already planted.
Running WordPress? Updating WordPress does not update PHP. How to update PHP in WordPress covers the control panel route most hosts use.
Coming up
After that date PHP 8.2 gets no more security fixes, including for whatever is found next. A site patched to 8.2.35 this month is fixed for PHP2Shell, but has weeks, not years, before it needs to move again.
PHP end of life dates and your optionsAbout this site
The CyPro team maintains this site. Version numbers, dates and mitigations come from the PHP project, the NCSC and CISA, and every page shows when it was last checked against them. Where sources disagree, the page says so and names each one.
Who we are and how pages are kept currentQuick answers
The most serious current PHP vulnerability is PHP2Shell, two critical flaws tracked as CVE-2026-109618 and CVE-2026-109619 and fixed on 21 October 2026. php.net says they affect all PHP installations serving web requests, and CISA has added both to its Known Exploited Vulnerabilities catalogue.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and later releases on those branches. PHP 8.1 and older get no fix from the PHP project.
Yes, on a supported branch kept up to date. Serious flaws turn up in every widely used platform; what separates a safe PHP site from an exposed one is whether it runs a supported version and gets security releases applied promptly. PHP 8.2 reaches end of life on 31 December 2026, so sites on 8.2 should plan their move now.
CyPro Ltd, the London cyber security consultancy, runs PHP Vulnerability. Every fact on the site is taken from the PHP project, the NCSC or CISA, and each page shows the date it was last checked against them.
Know your exposure
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.
