Important! Critical PHP vulnerabilities: update the version on your server

Two critical vulnerabilities have been discovered in the PHP interpreter core, with CVSS 4.0 scores of 9.2/10, identified as CVE-2026-109618 and CVE-2026-109619. They are collectively known as PHP2Shell.
Exploiting these vulnerabilities can lead to remote code execution (RCE), unauthorized access to information, system malfunctions, and the use of your server to launch cyberattacks.

All PHP versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are affected. This includes sites, applications, and popular CMS platforms built on PHP, such as WordPress, Drupal, OpenCart, 1C-Bitrix, as well as frameworks like Laravel. Since the PHP interpreter itself is vulnerable, updating any of the listed applications will not resolve the issue.
Information has emerged about the first attempts to exploit this vulnerability. The exploit has been demonstrated on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS.

The PHP developers have published configuration parameters that reduce the risks of certain exploitation scenarios. However, updating is the only way to fix the vulnerability.

What you need to do

1. Update your PHP version. The vulnerability is fixed in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. These defects cannot be resolved using application-level code — the only solution is to update PHP on the server. Mitigations only address some attack vectors.
2. Restart your services: PHP-FPM or the web server, queue handlers, and Apache with mod_php, to ensure no old code remains in memory.
3. Check the installed version using the php -v and php-fpm-<VERSION> -v commands.
4. Check your system for signs of compromise. After updating, verify that there are no unauthorized files, review event logs, and change passwords, keys, and tokens if necessary.

If you cannot take the necessary measures, isolate the server and restrict access to it from the internet.

The Servercore team.