Two critical PHP vulnerabilities prompted, on October 21, 2026, precautionary shutdowns of European public sites. In Tunisia, the National Cybersecurity Agency (ANCS) recommends urgent updates. Amazon reports an exploitation attempt as early as October 17: fixing the server is essential, but traces of activity prior to disclosure must also be examined.
What to remember
- Two vulnerabilities: CVE-2026-109618 and CVE-2026-109619, each rated 9.2/10 in CVSS 4.0.
- First detected attempt: October 17, 2026, according to Amazon Threat Intelligence, on a honeypot server.
- Fixes available since October 21: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- In Tunisia: official alert tunCERT/Vuln.2026-657, published by ANCS on October 21.
In France and elsewhere in Europe, sites taken offline as a precaution
In France, prefecture sites, tax services and Météo-France were temporarily unavailable on October 21, according to several French media outlets. The City of Paris confirmed it had put some services into maintenance in line with recommendations from the National Agency for the Security of Information Systems (ANSSI).
Reuters also reported preventive interruptions of public services, notably in the Netherlands and Finland. These suspensions aimed to give technical teams time to fix exposed systems.
A site under maintenance is not necessarily hacked. Preventive shutdowns, the existence of attack attempts, and actual compromise are three distinct situations.
PHP2Shell: two flaws at the core of a language used on the web
Grouped under the name “PHP2Shell,” the vulnerabilities CVE-2026-109618 and CVE-2026-109619 concern the PHP engine itself. They affect memory management and certain internal states of the program. Under certain conditions, an attacker without an account can execute code remotely or access sensitive information.
The risk therefore does not depend solely on the security of an extension or a site. It concerns servers running a vulnerable version of PHP, particularly with Apache mod_php or PHP-FPM, depending on the technical conditions of each environment.
According to W3Techs data as of October 21, PHP is used by 69.3% of sites with an identified server language. This percentage does not correspond to the total measured sites worldwide.
Amazon detected an attempt as early as October 17: why this changes the urgency
In an analysis published by its threat intelligence team, Amazon states it identified an exploitation attempt on October 17, 2026 on its MadPot honeypot server network, four days before the disclosure of the patches.
Other attempts were observed around October 21. Amazon believes that PHP2Shell is now being exploited widely in the wild. However, its analysis does not provide a verified number of servers actually compromised: attempts observed on honeypots do not prove that every attack succeeded on a real site.
Priority for IT leaders
Analyze logs from October 17, 2026, at a minimum. The review should cover web and PHP logs, unusual processes, file modifications and suspicious outgoing connections. An update protects against new exploitations, but does not automatically remove any prior compromise.
WordPress, Drupal, Joomla and Magento: concrete demonstrations
Calif, a research company, claims to have achieved unauthenticated code execution on tested versions of WordPress, Drupal, Joomla and Magento, among other applications. The researchers performed these demonstrations in controlled environments: this is not proof of hacking all sites using these software packages.
WordPress, for its part, issued an official warning on October 21: there is no core WordPress update that fixes PHP2Shell, because the flaw lies in PHP. Site owners must check the PHP version actually used by their hosting.
Patched versions: what should be installed?
The patches were released on October 21, 2026. According to the PHP Foundation, the release was initially scheduled for October 22. The leakage of the vulnerability identifiers on October 20 led administrators to move the date forward by one day.
| PHP Branch | Patched version released |
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
For Linux distributions using backported fixes, the displayed version number may not change: the administrator should consult the security advisory from the package vendor.
The branches PHP 7.4, 8.0 and 8.1, which are normally no longer maintained, benefited from minimal backports of the source code published exceptionally by the PHP team. They are aimed particularly at operators capable of compiling and deploying the fixes themselves or using an extended support provider. These are not new official releases with the usual support.
For the PHP 5.4 to 7.3 versions, the PHP project has not announced equivalent backports. Migration to a supported version is therefore the recommended path, subject to fixes possibly provided by some third-party vendors. PHP 8.2 will reach end of support on December 31, 2026: users should also plan a migration.
If the server cannot be patched immediately
The PHP project describes targeted waiting measures. They can reduce exposure, but do not constitute complete fixes. Their implementation is up to the system administrator and must take service availability into account.
- For CVE-2026-109618: temporarily set
memory_limit=-1in a configuration the application cannot override, with request and resource limits appropriate to the server or container level. This change can increase the risk of resource exhaustion if applied without proper controls. - For CVE-2026-109619: set
session.upload_progress.enabled=0in the server or PHP-FPM configuration, then restart all affected PHP processes. On PHP 8.5, the vendor also mentionsfatal_error_backtraces=0as a targeted mitigation. - If no reliable fix is possible: severely restrict access or temporarily take the vulnerable service offline. An application firewall provides additional protection, not a substitute for updating.
Cloudflare says it has deployed provisional rules on its application firewall. They can only protect traffic for sites that actually pass through its services and do not replace the PHP patch installation.
Tunisia: ANCS issued an official alert
On October 21, 2026, the National Cybersecurity Agency published the bulletin tunCERT/Vuln.2026-657. It mentions risks of remote arbitrary code execution, denial of service, loss of confidentiality, and data integrity breaches.
This alert concerns administrations, businesses, media, online marketplaces and other Tunisian organizations using vulnerable PHP applications. It does not constitute a finding of widespread compromise of Tunisian sites.
Action plan for Tunisian companies
- Inventory all exposed PHP environments, including secondary applications, shared hosting, containers, and software embedding their own PHP engine.
- Update to a patched version, or apply a patch certified by the distribution vendor; restart the affected services and verify the version actually loaded.
- Review logs from October 17 and search for signs of abnormal activity; if a breach is suspected, isolate the system and initiate an investigation.
- For WordPress sites: go to Tools → Site Health → Information → Server, then check the PHP update with the hosting provider.
- If the fix is impossible: deploy the provisional measures documented by PHP and reduce the server’s exposure until it is upgraded.
Not to be confused with WP2Shell, another WordPress vulnerability
The name PHP2Shell resembles WP2Shell, a distinct chain of vulnerabilities that affected WordPress core in July 2026. WordPress versions 6.9.5 and 7.0.2 notably fixed these issues before newer releases.
To protect a WordPress site, you must keep both PHP and WordPress up to date. Fixing one does not replace the other, and plugins and themes also require ongoing monitoring.
A discovery accelerated by artificial intelligence
Calif’s research was conducted with the help of artificial intelligence tools, under OpenAI’s Patch the Planet program. Wiz and the PHP security teams also contributed to the discovery, validation and patching of the flaws. The PHP Foundation underlines the importance of such coordination, but also the necessity of human expertise to produce and verify fixes.
The episode mainly reminds that a vulnerability in a widely shared software component can affect many services simultaneously. For Tunisian organizations, the priority is twofold: install the patches and search for signs of an attack since October 17.
