PHP2Shell: what the new PHP vulnerabilities actually mean for your website
October 28, 2026
Two critical vulnerabilities in PHP are being written up everywhere this week, and almost all of that coverage is for security teams, not for the person who actually owns a website. The question that matters if that is you is simpler than a CVE number: does this reach my site, and what do I do about it. That is what this piece answers.
Two critical remote code execution vulnerabilities in PHP's own runtime, now widely known as "PHP2Shell": CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0, critical, and both allow an attacker to run code on a vulnerable server without logging in first.
The PHP project fixed both on 21 October 2026, in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. On 26 October 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalogue, which is official confirmation that this is being actively exploited rather than a theoretical risk.
The flaws affect anything that serves PHP directly to the web: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP 8.1 and earlier are end of life. There is no PHP.net-built fix for those versions, only source-only backports that a hosting provider or Linux distribution has to build and ship themselves. For a site still on 8.1 or older, that is an upgrade conversation, not a patch.
If you manage your own server, or a developer or agency manages it for you, confirm two things today: the PHP version currently running, and that it has been updated to one of the four fixed releases above since 21 October. "We updated WordPress" is not the same question, because the flaw sits in PHP itself, not in the CMS built on top of it.
If you do not know who manages your server, that is the first thing to establish, before anything else on this list.
Gravitas does not build custom code in PHP. Where we write bespoke functionality for a client, our languages are Rust and TypeScript, with jQuery still in use on some established builds. That has no bearing on whether a given client's own hosting runs PHP somewhere in their stack, which is exactly why the next section is the one that matters to most of the people reading this.
Webflow's Trust Center, updated 26 October 2026, states:
"The Webflow Security team is actively tracking the critical PHP2SHELL vulnerabilities (CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560). Webflow's core services are not built on PHP and are not affected."
In practice, that means the Designer, the CMS, hosting and forms all run on Webflow's own infrastructure rather than a PHP server a client would need to patch themselves.
It is worth being precise about what that statement does and does not cover. It is a statement about Webflow's own platform. It does not address, and Webflow has not published anything addressing, a client's own custom code embeds or a third-party integration, a booking system, a help desk widget, a separately hosted blog, that happens to run on PHP. If a Webflow site talks to something else that is PHP-based, that something else still needs patching on its own merits, and that is not a question Webflow's statement answers either way.
Not every Gravitas client is on Webflow. For the ones who are, this section is where the risk genuinely sits. For the ones who are not, the earlier sections apply in full, and this platform note does not.
Whoever looks after your hosting, agency, developer or provider, ask them one thing: what PHP version is live right now, and has it been patched to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 since 21 October 2026. Everything else follows from the answer.
Sources: PHP project security advisory, 21 October 2026 · CISA, Known Exploited Vulnerabilities catalogue, added 26 October 2026 · Webflow Trust Center, PHP2SHELL vulnerabilities statement, updated 26 October 2026.
