{"data":{"case":{"actions":{"de":["Aktualisiere PHP auf **8.5.12, 8.4.27, 8.3.36 oder 8.2.35** oder neuer, je nach Zweig.","Starte Apache, PHP-FPM und alle dauerhaft laufenden PHP-Prozesse neu, damit die alte Version nicht mehr im Speicher ist.","Mit PHP 8.1 oder älter: Wechsle auf einen unterstützten Zweig, für diese Versionen gibt es keine offizielle Version mit dem Fix.","Mit einem Hosting-Paket: Frag deinen Hoster, ob das Update installiert ist, und vergleiche deine PHP-Version mit der Tabelle auf dieser Seite."],"en":["Update PHP to **8.5.12, 8.4.27, 8.3.36 or 8.2.35**, or newer, depending on your branch.","Restart Apache, PHP-FPM and every long-running PHP worker, so that the old version is no longer in memory.","On PHP 8.1 or older, move to a supported branch: there is no official release for these versions.","With a hosting plan, ask your host whether the update is installed, and compare your PHP version with the table on this page."]},"affected_from":"5.4","backports":["7.4","8.0","8.1"],"criteria":{"damage":{"de":"Bisher ist kein Schaden gemeldet.","en":"No damage has been reported so far.","met":false},"exploitation":{"de":"Am 23. Oktober 2026 waren keine Angriffe bekannt; die CISA stufte die Ausnutzung als „keine“ ein.","en":"No attacks in the wild were known on October 23, 2026; CISA rated exploitation as “none”.","met":false},"reach":{"de":"PHP läuft auf 69,3 % aller Websites, deren Serversprache bekannt ist (W3Techs, 23. Oktober 2026).","en":"PHP runs on 69.3 % of all websites whose server language is known (W3Techs, October 23, 2026).","met":true},"response":{"de":"Updates für vier PHP-Zweige zugleich, Quellcode-Patches für drei nicht mehr unterstützte Zweige und Schutzregeln, vorbereitet mit Google, AWS, Microsoft, Cloudflare und weiteren.","en":"Fixed releases for four PHP branches at once, source patches for three branches that are no longer supported, and protection rules prepared with Google, AWS, Microsoft, Cloudflare, and others.","met":true}},"cves":["CVE-2026-109618","CVE-2026-109619"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-416, CWE-755, CWE-824, CWE-1325","dates":[{"date":"2026-08-11","key":"reported"},{"date":"2026-08-24","de":"Wiz Research meldet unabhängig davon weitere Fehler","en":"Wiz Research reports further bugs, independently"},{"date":"2026-09-18","de":"OpenAI meldet weitere Angriffswege","en":"OpenAI reports further attack paths"},{"date":"2026-10-20","de":"Die CVE-Nummern werden vorab bekannt, mit falschem Wert 10,0","en":"The CVE numbers leak online, with a wrong score of 10.0"},{"date":"2026-10-21","key":"patched"}],"de":{"credit":"Calif, Wiz Research und OpenAI, unabhängig voneinander","fixed":"PHP 8.5.12, 8.4.27, 8.3.36 und 8.2.35 (21. Oktober 2026)","product":"PHP, die Sprache hinter den meisten Websites","summary":"Zwei Fehler in PHP selbst erlauben Angreifern, Webserver ohne Passwort zu übernehmen, bei WordPress, Drupal, Joomla und vielen anderen Anwendungen."},"disclosed":"2026-10-21","en":{"credit":"Calif, Wiz Research and OpenAI, independently of each other","fixed":"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 21, 2026)","product":"PHP, the language behind most websites","summary":"Two flaws in PHP itself let attackers take over web servers without a password, on WordPress, Drupal, Joomla and many other applications."},"figures":[{"de":"der Websites mit bekannter Serversprache laufen mit PHP","en":"of websites with a known server language run on PHP","value":"69.3 %"},{"de":"Anwendungen übernahmen die Entdecker, darunter WordPress","en":"applications taken over by the finders, WordPress among them","value":"11"}],"fixed_versions":[{"branch":"8.5","version":"8.5.12"},{"branch":"8.4","version":"8.4.27"},{"branch":"8.3","version":"8.3.36"},{"branch":"8.2","version":"8.2.35"}],"key":"php2shell","name":"PHP2Shell","product":"PHP","sources":[{"de":"PHP-Projekt: Sicherheits-Updates vom 21. Oktober 2026","title":"PHP project: security releases of October 21, 2026","url":"https://www.php.net/archive/2026.php"},{"de":"PHP Foundation: das Sicherheits-Update von heute","title":"PHP Foundation: today's PHP security release","url":"https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/"},{"de":"Calif: Analyse und Zeitleiste zu PHP2Shell","title":"Calif: PHP2Shell research and timeline","url":"https://calif.io/php2shell/"},{"de":"Wiz Research: PHP2Shell","title":"Wiz Research: PHP2Shell","url":"https://www.wiz.io/blog/php2shell-php-rce"},{"de":"Gemeinsame Seite der Entdecker, mit Demo-Videos","title":"The finders' joint page, with demonstration videos","url":"https://www.php2shell.com/"},{"de":"Sicherheitshinweis des PHP-Projekts zu CVE-2026-109618","title":"PHP security advisory for CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"de":"Sicherheitshinweis des PHP-Projekts zu CVE-2026-109619","title":"PHP security advisory for CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"de":"NVD: CVE-2026-109618","title":"NVD: CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},{"de":"CVE-Eintrag CVE-2026-109619, mit Einschätzung der CISA","title":"CVE record CVE-2026-109619, with CISA's assessment","url":"https://www.cve.org/CVERecord?id=CVE-2026-109619"},{"de":"W3Techs: Nutzungsstatistik von PHP","title":"W3Techs: usage statistics of PHP","url":"https://w3techs.com/technologies/details/pl-php"},{"de":"OpenAI: Patch the Planet, das Programm, in dem Calif PHP prüfte","title":"OpenAI: Patch the Planet, the program under which Calif audited PHP","url":"https://openai.com/index/patch-the-planet/"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2026}},"description":"Two flaws in PHP itself let attackers take over web servers without a password. The fixed PHP versions, the applications affected, and what to do now.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On October 21, 2026, the PHP project fixed two flaws in the language itself. With a single crafted request, an attacker can take over a web server before any website code runs and without a password. PHP runs on 69.3 % of all websites whose server language is known, from small blogs to large online shops.\nWhether a website is affected depends on the PHP version of its server, not on the version of WordPress, Joomla, or any other application. Your host\u0026rsquo;s control panel shows it, and so does the system information of most applications (see the table of applications below); on the server itself, the command php -v prints it.\nFixed PHP versions Fixed releases by branch BranchStatus PHP 8.5fixed from 8.5.12 PHP 8.4fixed from 8.4.27 PHP 8.3fixed from 8.3.36 PHP 8.2fixed from 8.2.35 PHP 7.4, 8.0, 8.1affected; no official release, only source patches from the PHP team PHP 5.4 – 7.3affected; no fix PHP applications: what they need and where they show your PHP version 61 widely used applications that run on PHP. Each one is affected only through the PHP version of the server it runs on. 7 of them carry a warning sign: a version the vendor still maintains runs only on PHP without a fix, or the vendor has not yet shipped the fixed PHP.\nFind your application Application PHP it needs Where it shows the PHP version Takeover shown by the finders Adminer administration Version 6.1: PHP 5.3 or newerA single PHP file that runs on whatever PHP the server has. no confirmed path – Backdrop CMS CMS Version 1.35: PHP 7.1 or newer Reports \u0026gt; Status report, row “PHP” – BookStack wiki Version 26.09: PHP 8.2 or newerBookStack published its own warning on October 21, 2026. It notes that Ubuntu\u0026#39;s fixed packages keep older version numbers. Vendor\u0026#39;s notice no confirmed path – Cacti monitoring Version 1.2.31: PHP 8.1 or newerCacti\u0026#39;s own sources disagree: the README of 1.2.31 still names PHP 5.4. Utilities \u0026gt; Technical Support \u0026gt; Summary, row “PHP Version” – Concrete CMS CMS Version 9.5: PHP 7.3 to 8.5 Dashboard \u0026gt; System \u0026amp; Settings \u0026gt; Environment \u0026gt; Environment Information – Contao CMS Version 6.0: PHP 8.4 or newerContao 5.3 accepts PHP 8.1, which gets no fixed release. no confirmed path – Craft CMS CMS Version 5: PHP 8.2 or newerCraft 4 accepts PHP 8.0.2 and newer. Utilities \u0026gt; PHP Info – DokuWiki wiki Version 2026-07-14: PHP 8.2 or newerOpen the check page while signed in as an administrator. ?do=check – Dolibarr ERP CRM CRM Version 24.0: PHP 7.2 to 8.5 Dolibarr 18 LTS supports only PHP 7.1 to 8.1, which gets no fixed release. Home \u0026gt; Admin Tools \u0026gt; PHP, row “Version” – Drupal CMS Version 11.4: PHP 8.3 to 8.5Drupal 10.6 runs on PHP 8.1 to 8.4. Drupal 11.4.11 (October 21, 2026) also replaces an outdated PHP setting in the .htaccess file. Reports \u0026gt; Status report, row “PHP” yes, on version 11.4.3 EspoCRM CRM Version 10.0: PHP 8.3 to 8.5 Administration \u0026gt; System Requirements – Flarum forum Version 2.0: PHP 8.3 or newerFlarum 1.x accepts PHP 7.3 and newer. Admin \u0026gt; Dashboard, row “PHP” – FreePBX network Version 17: PHP 8.2 or newerThe official installer sets up PHP 8.2 from Debian 12. The fix arrives as a Debian security update, whose version number need not read 8.2.35. no confirmed path – FreshRSS other Version 1.30: PHP 8.1 or newerVersions 1.30.3 and 1.30.4 (October 21, 2026) move the Docker images to fixed PHP releases; pull the new image. Vendor\u0026#39;s notice Administration \u0026gt; Check installation – Froxlor hosting Version 2.3: PHP 7.4 to 8.5Also manages PHP for the websites it hosts. no confirmed path – Gambio online shop Version 26.10: PHP 8.2 to 8.3PHP 8.2 gets security fixes only until December 31, 2026. no confirmed path – GLPI help desk Version 12.0: PHP 8.3 or newerGLPI 10, still updated, accepts PHP 7.4 and newer. no confirmed path – Grav CMS Version 2.2: PHP 8.3.11 or newerGrav 1.7 accepts PHP 7.3.6 and newer. no confirmed path – Icinga Web monitoring Version 2.14: PHP 8.2 or newer About, row “PHP Version” – ILIAS learning platform Version 11: PHP 8.3 to 8.4 (recommended: 8.4)ILIAS 9 runs only on PHP 8.1 and 8.2. no confirmed path – ISPConfig 3 hosting Version 3.3: uses the PHP packages of the Linux distributionAlso manages PHP for the websites it hosts. ISPConfig\u0026#39;s warning of October 21, 2026 says attacks have already been seen; the PHP project has not said so. Vendor\u0026#39;s notice no confirmed path – Joomla CMS Version 6.2: PHP 8.3 or newer (recommended: 8.4)Joomla 5, still in use, accepts PHP 8.1, which gets no fixed release. System \u0026gt; Information \u0026gt; System Information, row “PHP Version” yes, on version 6.1.4 JTL-Shop online shop Version 5.8: PHP 8.3 or newer no confirmed path – Kanboard collaboration Version 1.2: PHP 8.1 or newerVersion 1.2.56 (October 21, 2026) moves the official Docker image to PHP 8.5.12, which contains the fix. Vendor\u0026#39;s notice Settings \u0026gt; About, row “PHP version” – Kirby CMS Version 5: PHP 8.2 to 8.5 (recommended: 8.4) Panel \u0026gt; System, row “PHP” – Laravel framework Version 13: PHP 8.3 to 8.5A framework: applications built on it run on the server\u0026#39;s PHP. Laravel 12 runs on PHP 8.2 to 8.5. no confirmed path yes, on version 13.11 LibreNMS monitoring Version 26.10: PHP 8.4 or newer (recommended: 8.5) /about, row “PHP” – LimeSurvey Community Edition surveys Version 7: PHP 8.1.29 to 8.5 LimeSurvey 5.x (PHP 7.2.5 to 8.0) and 3.x (up to PHP 7.4) run only on PHP versions that get no fixed release. Configuration \u0026gt; Settings \u0026gt; Global settings \u0026gt; Overview – Magento Open Source / Adobe Commerce online shop Version 2.4.9: PHP 8.3 to 8.5 (recommended: 8.5) Versions 2.4.4 and 2.4.5 still get security fixes but run only on PHP 8.1, which gets no fixed release; 2.4.6 runs on 8.1 or 8.2. no confirmed path yes, on version 2.4.9 Matomo On-Premise web analytics Version 5.14: PHP 7.2.5 or newerMatomo\u0026#39;s FAQ names PHP 8 for version 5; the code still accepts 7.2.5. Administration \u0026gt; Diagnostic \u0026gt; System Check – Mautic CRM Version 7: PHP 8.2 to 8.5Mautic 5.2 and 6.0 run on PHP 8.1 to 8.3. no confirmed path – MediaWiki wiki Version 1.46: PHP 8.3 to 8.5The page also shows how PHP runs: apache2handler means mod_php, where the risk is highest. MediaWiki 1.43 LTS accepts PHP 8.1. Special:Version, row “PHP” yes, on version 1.46.2 MODX Revolution CMS Version 3.2: PHP 8.1 or newer Reports \u0026gt; System Info, row “PHP Version” – Moodle LMS learning platform Version 5.3 LTS: PHP 8.3 to 8.4Moodle 4.5 LTS accepts PHP 8.1 and newer. Site administration \u0026gt; Server \u0026gt; PHP info – MyBB forum Version 1.8: PHP 5.2 or newerThe installer accepts PHP as old as 5.2. Admin CP \u0026gt; Home, row “PHP Version” – Neos CMS Version 9.2: PHP 8.4 to 8.5Neos 8.4 to 9.1 run on PHP 8.2 to 8.5. no confirmed path – Nextcloud Server collaboration Version 35: PHP 8.3 to 8.5 (recommended: 8.5)Nextcloud 33 runs on PHP 8.2 to 8.5. no confirmed path yes, on version 35.0.1 OpenCart online shop Version 4.1: PHP 8.0 or newerThe code of version 4.1 requires PHP 8.1 or newer. no confirmed path – OPNsense (web interface) network Version 26.7.7: ships PHP 8.5.11; only the vendor can update it PHP is updated only through firmware updates (System \u0026gt; Firmware \u0026gt; Status). The newest PHP listed for 26.7 is 8.5.11, older than the fixed 8.5.12. no confirmed path – osTicket help desk Version 1.18: PHP 8.2 to 8.4 (recommended: 8.4) Admin Panel \u0026gt; Dashboard \u0026gt; Information, row “PHP Version” – ownCloud Server (Classic) collaboration Version 10.16: PHP 7.4 only ownCloud 10.16, still updated, supports only PHP 7.4, which reached its end of life in 2022 and gets no fixed release. ownCloud Classic 11 needs PHP 8.3 and brings it in its Docker images. no confirmed path – OXID eShop online shop Version 7.5: PHP 8.3 to 8.5 no confirmed path – pfSense (web interface) network Version CE 2.9.0: ships PHP 8.5.7; only the vendor can update it PHP is part of the firewall system, so only an update from Netgate brings the fix. CE 2.9.0 ships PHP 8.5.7, older than the fixed 8.5.12. no confirmed path – phpBB forum Version 3.3: PHP 7.2 to 8.3 Administration Control Panel \u0026gt; General, row “PHP version” – phpMyAdmin administration Version 5.2.3: PHP 7.2 to 8.3Officially supported only up to PHP 8.3. The older 4.9 branch runs only on PHP 7.4 or older, which gets no fixed release. Home page \u0026gt; Web server, row “PHP version” yes, on version 5.2.3 Piwigo other Version 16.4: PHP 8.2 or newerThe code still accepts PHP 7.4. no confirmed path – PrestaShop online shop Version 9.1: PHP 8.1 to 8.5 (recommended: 8.5) PrestaShop 8, still maintained, supports only PHP 7.2 to 8.1, which gets no fixed release: upgrade to version 9, or ask your host whether it has built in a backport. Advanced Parameters \u0026gt; Information – ProcessWire CMS Version 3.0: PHP 7.1 or newer no confirmed path – Roundcube Webmail webmail Version 1.7: PHP 8.1 to 8.5The 1.6 line accepts PHP 7.3 and newer. no confirmed path yes, on version 1.7.4 Shopware 6 online shop Version 6.7: PHP 8.2 or newer (recommended: 8.4)The code of versions 6.6 and 6.7 accepts PHP 8.2 to 8.5. no confirmed path – Silverstripe CMS CMS Version 6.2: PHP 8.3 to 8.5 no confirmed path – SnappyMail webmail Version 2.38: PHP 7.4 or newerNo new release since October 2024. no confirmed path – Statamic CMS Version 6: PHP 8.3 or newerBuilt on Laravel. Control Panel \u0026gt; Utilities \u0026gt; PHP Info – SuiteCRM CRM Version 8.10: PHP 8.2 to 8.4SuiteCRM 8.9 runs on PHP 8.1 to 8.3, version 7.14 on 8.1 and 8.2. no confirmed path – Sylius online shop Version 2.3: PHP 8.3 or newerBuilt on Symfony. Sylius 1.14 accepts PHP 8.1, which gets no fixed release. no confirmed path – Symfony framework Version 8.1: PHP 8.4 or newerA framework. Symfony 6.4 LTS accepts PHP 8.1, which gets no fixed release. no confirmed path yes, on version 8.1 TYPO3 CMS Version 14 LTS: PHP 8.2 to 8.5TYPO3 13 LTS has the same range. Toolbar \u0026gt; System Information, row “PHP version” – WHMCS hosting Version 9.1: PHP 8.2 to 8.4 (recommended: 8.4)WHMCS 8.13 LTS runs on PHP 7.2 to 8.3, including versions that get no fixed release. no confirmed path yes (no version named) WooCommerce online shop Version 11.2: PHP 7.4 to 8.4 (recommended: 8.3)8.4 is the highest version WooCommerce has tested. It runs inside WordPress and uses the PHP of the WordPress site. WooCommerce \u0026gt; Status \u0026gt; Server environment, row “PHP version” – WordPress CMS Version 7.1: PHP 7.4 to 8.5 (recommended: 8.3) Tools \u0026gt; Site Health \u0026gt; Info \u0026gt; Server, row “PHP version” yes, on version 7.1.2 Zabbix (web frontend) monitoring Version 7.4: PHP 8.0 to 8.5Only the web frontend runs on PHP. Zabbix 6.0 LTS runs on PHP 7.2.5 to 8.3. no confirmed path – From the applications\u0026#39; own documentation and source code, checked on October 23, 2026. Only applications whose code base is confirmed to be PHP are listed. If a provider runs the application for you, the provider updates PHP.\nHow the attack works When a request needs more memory than PHP allows, PHP stops it at once and jumps out of the code that was running. The finders discovered that this can happen at the worst possible moment: halfway through building a list of uploaded files, or while data from the request is still in use. What is left behind is half-built data that PHP later treats as complete.\nAn attacker can trigger this from outside with an upload request built to run out of memory at exactly that point, without logging in and before the website\u0026rsquo;s own code even starts. The second flaw goes further: leftover data from one request survives into the next request handled by the same worker process, which then reuses memory that was already freed. Together, the two flaws let an attacker read the server\u0026rsquo;s memory and run commands with the rights of the web server.\nAttackersends a crafted upload request PHPruns out of memory halfway through Half-built datastays behind in memory Next requestruns the attacker\u0026#39;s commands The attack in four steps: it works before any application code runs, so it does not matter which application the website uses. According to the PHP project, every PHP installation that serves web pages is at risk: as an Apache module, through PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed. The risk is highest with the Apache module, where the attack works before any application code runs; with PHP-FPM, the finders needed a route through the application.\nWhich applications are affected Every application that runs on an affected PHP version is exposed, because the flaw sits underneath it. The finders took over servers running these eleven applications in their tests:\nApplicationVersion tested WordPress7.1.2 Drupal11.4.3 Joomla6.1.4 MediaWiki1.46.2 Roundcube1.7.4 Magento2.4.9 phpMyAdmin5.2.3 Nextcloud35.0.1 Laravel13.11 Symfony8.1 WHMCSnot stated The list of applications under the check above shows more PHP applications, the PHP versions they need, and where they show the PHP version of your server.\nThree scores for the same flaw The PHP project rates both flaws 9.2 on version 4.0 of the CVSS scale. The US National Vulnerability Database gives 9.8 on version 3.1, the scale this series uses for every case. A score of 10.0, which spread online the day before the release, was wrong, the PHP Foundation says.\nSeverity scores for PHP2Shell PHP project (CVSS 4.0)9.2 NVD (CVSS 3.1)9.8 Leak of October 20 (wrong)10 The PHP project rates the attack as harder to carry out than the NVD does, which lowers its score.\nA release under pressure The flaws were reported to PHP from August 2026, by Calif, Wiz Research, and OpenAI, independently of each other. The PHP Foundation says a core developer had seen first signs of the same root cause in 2024, when exploitation was not yet proven. The release was planned for October 22; the last day before it went differently.\nOctober 20 and 21, 2026 (UTC) 1 2 3 4 1October 20, 2026The two CVE numbers circulate on forums and social media, with a wrong score and release time 2October 20, 2026PHP publishes its pre-announcement early and moves the release forward by one day\u0026#43;0 days 3October 21, 2026A container vendor publishes images with the fix more than six hours early, breaking the embargo\u0026#43;1 day 4October 21, 2026The fixed releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35 come out at 14:00\u0026#43;1 day On the evening of October 20, one of the finders also published a video of the attack by mistake; it was deleted but copied widely. The finders\u0026rsquo; joint page php2shell.com shows the demonstrations on WordPress, Drupal, and Joomla.\nOn October 23, 2026, no attacks in the wild were known, and the US agency CISA rated exploitation as “none”. The finders have published how the attack works, so the update should not wait.\nFound with AI, flooded by AI PHP2Shell also shows how AI is changing the search for vulnerabilities. The PHP Foundation brought PHP into Patch the Planet, a program by OpenAI in which security firms help open-source projects find and fix flaws; as part of it, Calif began auditing PHP on July 30, 2026. Wiz says it found its first bug with its own tool, Wiz Atlas, and the AI models Gemini 4 Argon and GPT-5.6 Sol. Earlier in 2026, the PHP Foundation had already had PHP scanned with Anthropic\u0026rsquo;s model Claude Mythos, together with the Alpha-Omega project.\nThe other side: the PHP security team now receives far more reports than before. Since July 1, 2026, it has published 15 CVEs and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. AI helps the team sort the reports, the PHP Foundation says, but a person makes every decision and works on every patch.\nReports to the PHP security team since July 1, 2026 Published as CVEs15 Invalid, duplicates or not reproducible (more than)100 Source: PHP Foundation, October 21, 2026.\nIf you cannot update today The PHP project and the finders name settings that make an attack harder until the update is installed. They warn that these settings do not cover every variant of the attack.\nSwitch off upload progress tracking: set session.upload_progress.enabled to off. Lower the request limits: reduce post_max_size and max_input_nesting_level to what your site needs. Hide error details: set display_errors to off; on PHP 8.5, also switch off fatal_error_backtraces. Restart workers more often: a lower pm.max_requests in PHP-FPM shortens how long leftover data can survive. Some advisories also suggest setting memory_limit to -1, which removes the out-of-memory trigger. Without a memory limit, a single request can use up all of the server\u0026rsquo;s memory, so only do this together with a limit at the operating-system level, and update as soon as you can.","title":"PHP2Shell: the flaws in PHP that put most websites at risk","url":"https://crackthe.net/vulnerabilities/php2shell/"}