Security researchers have reported two critical remote code execution security vulnerabilities in PHP. PHP’s security team has scheduled an out-of-cycle security release for 1400 UTC today (October 21, 2026).

With our blog, we will understand what the RCE vulnerabilities in PHP are about, how they impact organizations, and what organizations should do.

About PHP2Shell

These vulnerabilities are caused by a flaw in how PHP manages computer memory. Attackers can send a specially designed request to exploit this flaw and run their own commands on the server, allowing them to steal data, install malware, or alter websites.

What can attackers do with the vulnerabilities?

By exploiting the vulnerabilities, attackers can:

• Execute arbitrary commands or code on vulnerable PHP servers, potentially without authentication (remote code execution)
• Gain control over affected applications or servers, depending on the execution privileges (server compromise).
• Access sensitive application data, credentials, configuration files, and stored information (data exposure).
• Modify website content, deploy malicious files, or disrupt application availability (web application disruption).
• Use a compromised server for lateral movement, persistence, or attacks against connected systems (web application disruption).

Official security guidance

• Monitor the official PHP security announcements and upgrade to the fixed release for the applicable supported PHP branch as soon as it is available.
• Inventory all PHP installations, including those bundled with web applications, appliances, and hosting control panels.
• Check vendor and operating-system distribution advisories for patched or backported packages.
• For unsupported PHP versions, prioritize migration to a supported release. If immediate remediation is not possible, restrict public exposure or isolate affected applications.
• PHP had not published a confirmed workaround in the initial advisory; temporary controls should not be considered a replacement for patching.

SharkStriker’s recommendations

• Identify all PHP-based applications, servers, and internet-facing assets within the environment.
• Verify installed PHP versions and determine exposure once the official affected-version information is published.
• Apply the vendor-recommended security updates immediately after confirming the applicable fixed release.
• Restrict public access to vulnerable applications where patching cannot be completed promptly; consider temporary isolation or appropriately configured WAF controls.
• If exploitation is suspected, isolate the affected host where operationally appropriate, preserve evidence, investigate the incident, and follow the incident response process.