Most security bugs get a CVE, a polite advisory, and a collective shrug. This week's PHP flaws got something rarer: national cybersecurity agencies on three continents telling people to update or pull the plug. When the FBI and NSA are casually suggesting you take your website offline, it's not a "patch it next sprint" situation.

Two CVEs, One Very Bad Wednesday

On October 21, the PHP project shipped fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2. Nicknamed "PHP2Shell," the pair lets unauthenticated attackers run code inside PHP's request-parsing layer, before your application logic ever gets a vote. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; anything older is exposed, and PHP 8.1 and earlier get no official fix at all.

The fallout was immediate. Cybersecurity agencies in the U.S., U.K., EU, Canada, Australia and Japan urged organizations to find and patch PHP systems, and some sites in Finland, the Netherlands, Belgium and France went fully or partly offline. Palo Alto Networks counted more than 22.6 million potentially vulnerable internet-facing instances, and Cloudflare reported exploit attempts climbing from thousands before disclosure to millions the following day.

Your Plugins Can't Save You This Time

Here's the part that trips people up: this isn't a WordPress bug or a Drupal bug. It sits underneath both, in the runtime itself, so no module update, plugin patch or CMS release closes the hole. The Drupal Security Team's own advisory put it bluntly: updating to a patched PHP release is the only complete mitigation. If your host manages PHP, the ball is in their court. If you manage PHP yourself, congratulations, it's in yours.

The quietly fascinating angle is that the flaws were found with help from AI tools, and coordinated disclosure gave major vendors a head start. Cloudflare had WAF rules live for every plan, Free included, roughly nine hours before the public announcement. That's the good news. The bad news is that a WAF is a seatbelt, not a brake pedal; Cloudflare says itself that the real fix is updating PHP on the server. And because some distributions backport patches without bumping the visible version number, "what version am I on?" became a surprisingly philosophical question this week.

The lesson isn't "PHP is scary." It's that your security posture is only as current as the oldest layer in your stack, and the layer nobody looks at is usually the one that bites.

If you're not sure which PHP build is actually running under your Drupal site, or whether your host has really patched it, our team can check that for you before somebody else's scanner does.

Source: WJLA / The National Desk