Insurance wiki

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Reviewed by the Apex broking team · Last reviewed 2026-10-22

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026, that let attackers run code on web servers without logging in. It matters for insurance because cover for an attack through a known, unpatched flaw can depend on your cyber policy's security and notification conditions.

Part of: PHP2Shell and cyber insurance

What is PHP2Shell?

PHP2Shell is a nickname used by security researchers, not an official name; the php.net advisory refers to the flaws by their CVE numbers. The PHP project pre-announced an emergency release on 20 October 2026 after details leaked, and published fixes on 21 October 2026.

Both allow unauthenticated remote code execution: an attacker who has never logged in may be able to run their own code on the server.

Who is affected?

php.net says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.

• Unsupported versions: PHP 8.1 and older get no official release. Minimal source backports were published for 7.4, 8.0 and 8.1, and some Linux distributions ship patched packages under older-looking version numbers. PHP 8.2 reaches end of life on 31 December 2026.
• CMS sites: WordPress, Drupal, Joomla, Magento and other PHP applications depend on the server's PHP, so updating the CMS or plugins alone does not fix it. See PHP2Shell and WordPress sites.
• Hosted sites: on shared or managed hosting the host usually controls the PHP build, while the site owner often picks the PHP version in the control panel. See how to check your website PHP version.

How is it fixed?

php.net is clear: "There are no complete mitigations, updating is the only safe choice." Server settings such as disabling session upload progress or lowering post size limits reduce exposure to specific attack paths but do not make an installation safe. The NCSC alert of 21 October 2026 tells UK organisations to identify all systems running PHP, internet-facing first, prepare to update immediately and apply the updates once released, monitor for malicious activity, consider taking systems offline if they cannot be fixed, and check third-party products that bundle PHP. As of 21 to 22 October 2026, several security firms reported exploitation attempts.

Why PHP2Shell matters for insurance

A cyber policy commonly covers the costs of an attack, such as incident response, forensics, data restoration, business interruption and liability, subject to its wording. Because a fix is now public, cover for an attack through an unpatched server can turn on the policy's security conditions; see does cyber insurance cover unpatched vulnerabilities. PI policies, and many cyber policies, are written on a claims-made basis, so prompt notice of an incident or circumstance matters; see the first 72 hours of a cyber incident. Web agencies and hosts may also face client claims under technology PI; see PHP2Shell liability for agencies and hosts.

For the full checklist and how cover usually responds, read PHP2Shell: what it means for your cyber insurance. If your site is hosted by someone else, see do I need cyber insurance if my website is hosted, and for wider context, what cyber insurance does not cover and cyber incident notification.

Sources

• php.net: Security advisory, critical remote code execution vulnerabilities (21 October 2026)
• NCSC: Critical security issue affecting PHP (21 October 2026)

Frequently asked

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.