Operations | Monitoring | ITSM | DevOps | Cloud

A critical security vulnerability can put an entire business at risk before IT teams have even established where the problem lies. For CIOs, that means needing immediate answers about which systems are exposed, how essential business services could be affected and how quickly their teams can get ahead of the threat. That was the challenge facing organizations on October 21, when two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, emerged.

On 21 October 2026, the team behind PHP released an emergency fix for two critical security flaws. PHP is the programming language behind a large share of the web, including WordPress, Drupal and many online stores. Researchers at Wiz named the flaws PHP2Shell. An attacker could use them to take control of a website without ever logging in. Updating a website, its CMS, or its plugins doesn't help. The only real fix is (and was) a new version of PHP itself.

TL;DR On October 21, 2026, PHP released emergency patches for two critical flaws known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). An attacker with no credentials can use them to run code on a PHP web server, in some cases with a single HTTP request. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now. Then go through your logs, because exploitation attempts were recorded before the patch shipped. In this post.

On October 20th, 2026, the PHP Security Team issued an advanced notice and security advisory disclosing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS v4.0 9.2, affecting PHP installations.

Last updated: October 21, 2026. We'll update this article as PHP and Linux distributions publish new information. PHP2Shell is the nickname of two critical vulnerabilities in PHP that let an attacker run code on a web server without logging in. PHP released the fixes on October 21, 2026, and IT and security teams now need to know which of their servers and computers run a vulnerable PHP version, so they can patch those first.

Discover how php2shell vulnerabilities expose PHP servers to remote code execution and how Harness virtual patching protects endpoints while you deploy fixes. On October 21, 2026, the PHP project rushed out emergency patches for two critical flaws nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10). This isn't a bug in some plugin or a server someone set up wrong. It's in PHP itself, in the way the language has handled errors since 2012.

How to monitor a PHP application in production: reading the PHP-FPM status page, checking OPcache health, and finding the request that is actually slow. Sejal Pandey works on content and growth at Last9, writing about observability, reliability, and SRE practices.

Laravel and Ruby on Rails are both full-stack, batteries-included MVC frameworks with an ORM, a templating engine, a CLI, and a shared philosophy: going from an empty folder to a working app shouldn't take fifty decisions first. Laravel wins when your team already lives in PHP, or when you want the largest possible pool of developers, packages (code other people have already written for common tasks), and hosting options to choose from.

Good news for PHP developers: AppSignal monitoring is now available for PHP applications. Our new package brings traces, metrics, and logs from your PHP app into AppSignal, with auto-instrumentation for frameworks like Laravel and Symfony and a foundation built on OpenTelemetry. Already using AppSignal's PHP package and want the latest updates? Migrating is straightforward: remove your current OpenTelemetry setup and follow our new install guide.