Short answer: two critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) can let an attacker run code on a server without logging in, on any site that runs an unpatched PHP version. The PHP project released fixed versions on 21 October 2026, and on the same day Turkey’s Cyber Security Directorate announced a nationwide scan and sent urgent notices to organisations. 360 Soft checks whether your sites and servers are affected, applies the patch or a temporary mitigation, and, where needed, upgrades your PHP version without downtime. Our team works from Istanbul for clients in the EU, the UK, the US and the Middle East.
What happened: a short timeline
- 20 October 2026: the CVE identifiers of the flaws leaked publicly. The PHP project announced an emergency security release for the next day.
- 21 October 2026, 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. The PHP security team rated both flaws 9.2 under CVSS v4.0.
- Evening of 21 October 2026: Turkey’s Cyber Security Directorate announced a nationwide scan and said affected systems must be upgraded to safe versions without delay and external access to critical PHP services must be restricted.
- In the field: Cloudflare and watchTowr reported the first exploitation attempts. Researchers demonstrated unauthenticated remote code execution on WordPress, Drupal, Joomla and Magento.
Which PHP versions are affected?
According to researchers, the affected code path has existed since PHP 5.4, so almost every PHP version used in the last decade is at risk. The table shows what to do for each version branch.
| Your version | Status | What to do |
|---|---|---|
| PHP 8.5 | Affected before 8.5.12 | Update to 8.5.12 |
| PHP 8.4 | Affected before 8.4.27 | Update to 8.4.27 |
| PHP 8.3 | Affected before 8.3.36 | Update to 8.3.36 |
| PHP 8.2 | Affected before 8.2.35 | Update to 8.2.35, and plan a move to 8.3 or 8.4 because 8.2 support ends on 31 December 2026 |
| PHP 8.1, 8.0, 7.4 | Affected, no official PHP release | Vendor patch (cPanel, CloudLinux) plus migration to 8.3 or 8.4 |
| PHP 7.3 and older | Affected, no fix in most environments | Temporary mitigation plus an urgent version upgrade or platform change |
Is your site affected? A three-step check
- Find your PHP version. In WordPress go to Tools > Site Health > Info > Server; in cPanel open “Select PHP Version” or “MultiPHP Manager”. If the version is below the safe release in the table, the site is at risk.
- Identify the hosting type. On shared hosting the provider applies the patch. On a VPS, cloud instance, container platform or your own server, the responsibility is yours.
- List every system. The main website is rarely the only risk. Campaign microsites, dealer and partner portals, old subdomains, staging and demo installs, CRM and internal tools carry the same flaw.
Measures for the first 24 hours
- Apply the patch. According to the PHP advisory, updating is the only complete fix.
- If patching is delayed, mitigate: set
session.upload_progress.enabled = 0in php.ini or the PHP-FPM pool (for CVE-2026-109619) and enforce a memory limit the application cannot override (for CVE-2026-109618). Restart all PHP processes afterwards. A.user.ini file or ini_set() is not sufficient for this setting. - WAF rules: rules published by Cloudflare, Imunify360 and similar services block known attack patterns. They are not a permanent fix.
- Restrict external access: expose admin panels and critical PHP services only to trusted IP addresses. Close systems to international traffic if they do not need it.
- Back up: before updating, store a file and database backup outside the server.
Signs of an attack
Because the flaw sits underneath the application, application logs often stay silent. Warning signs in server logs include unusual multipart requests that end in memory-limit errors, bursts of HTTP 500 responses, abnormally large PHPSESSID cookies and unexplained PHP process restarts. If you see any of these, patching alone is not enough: database passwords, API keys and admin accounts should be rotated and file integrity should be checked.
Emergency response packages from 360 Soft
| Package | Scope | For whom |
|---|---|---|
| Emergency Patch | Version detection, backup, patch or temporary mitigation, restart of PHP processes, verification report | Single sites, businesses with a VPS or their own server |
| Version Upgrade | Migration from 7.x / 8.0 / 8.1 to 8.3 / 8.4, compatibility tests, plugin and library updates, rollback plan | WordPress, Laravel, CodeIgniter and custom PHP applications stuck on old versions |
| Enterprise Audit | Inventory of all domains and servers, vulnerability scan, compromise and intrusion check, credential rotation plan, report for management and auditors | Groups and holdings, finance, healthcare, public sector, e-commerce and multi-brand organisations |
| Platform Change | Migration of unpatchable legacy PHP systems to.NET, Node.js or current Laravel | Systems with old, hard-to-maintain source code that carry critical workloads |
For details see PHP version upgrade, enterprise PHP security audit and PHP to.NET migration. If you need ongoing scanning and prioritisation after the emergency, our vulnerability management outsourcing service keeps track of new CVEs across your estate, and SOC and security monitoring watches for suspicious activity around the clock.
How we work with international clients
- Remote first: almost all work is done over VPN or a jump host with time-limited, logged access. On-site support in Turkey is possible.
- Shift coverage: 24/7 shifts can be arranged for incidents, and patches and restarts are scheduled in your low-traffic window, whatever your time zone.
- Team size: from a single engineer for one site to a larger team for an estate of hundreds of applications; we scale teams from 1 to 200+ people.
- Start: emergency work starts immediately after scoping; longer upgrade or migration teams typically start within 1 to 2 weeks.
Who is most exposed?
- Banks, payment and insurance companies: customer data and transaction security; in Turkey, audit duties under BDDK and SPK information-systems regulations.
- Healthcare providers: patient data is a special category of personal data under KVKK and GDPR, so liability after a breach is heavy.
- Public bodies and municipalities: the urgent notice of Turkey’s Cyber Security Directorate addresses these organisations directly.
- E-commerce and retail: checkout pages, customer accounts and the cost of downtime during campaigns.
- Groups and multi-brand companies: dozens of domains, old campaign sites and systems built by different agencies create one large blind spot.
If a personal data breach occurs, KVKK expects the data controller to notify the Turkish Personal Data Protection Board within 72 hours of becoming aware of it; the GDPR sets a similar 72-hour window for EU and UK supervisory authorities. The rules of your own country and sector apply in addition, so involve your legal or compliance team early. Delaying a known patch increases both reputational and legal exposure if a breach happens.
Contract, NDA and data protection
We work under a B2B service agreement with a clear scope and statement of work. An NDA is signed before the first technical call if you need one. All code, scripts, configurations and reports produced for you are assigned to you (IP assignment). Where we access personal data, we sign a GDPR data processing agreement with Standard Contractual Clauses (or the UK IDTA for UK data), and our own processing in Turkey follows KVKK. Access is granted under a permission matrix, closed when the work ends and documented in the final report.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP interpreter, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team rated both 9.2 under CVSS v4.0. They can allow remote code execution without authentication.
My application code is secure. Am I still affected?
Yes. The flaw is not in your application code but in the PHP interpreter itself. WordPress, Laravel, Magento, Drupal, Joomla or custom PHP makes no difference: every site running on an unpatched PHP version is at risk.
Which PHP versions are safe?
The PHP security releases of 21 October 2026 are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No official PHP release was published for 8.1, 8.0 and 7.4; for these branches, vendors such as cPanel and CloudLinux ship fixes in their own packages. For 7.3 and older there is no fix in most environments.
I use shared hosting. What should I do?
On shared hosting the provider updates the PHP packages. Ask your provider to confirm in writing that the patched PHP package is installed and that session.upload_progress.enabled is switched off. If your site runs on 8.1 or older, plan a move to 8.3 or 8.4.
How can I tell whether I have been attacked?
Signs shared by security researchers include unusual multipart requests ending in memory-limit errors, repeated HTTP 500 responses, abnormally large PHPSESSID cookies and unexplained PHP process restarts. Application logs often show nothing because the problem runs underneath the application. If in doubt, a forensic review and credential rotation are needed.
How quickly does 360 Soft respond?
We make the first assessment on the same day we receive the request. On a single-server site the patch or temporary mitigation is usually completed within 24 hours. For multi-server, legacy or custom-built estates we first build an inventory and then work through it by priority.
Is a WAF rule enough?
No. WAF rules from Cloudflare, Imunify360 and similar services block known attack patterns and buy time, but new variants can bypass them. The complete fix is updating PHP.
Can you work in our time zone and outside office hours?
Yes. Requests are passed to the team outside office hours as well, and patches and restarts are planned in your low-traffic window. 24/7 shifts can be arranged for incident work.
Do you sign an NDA and a data processing agreement?
Yes. An NDA can be signed before the first call. Where personal data is involved we sign a GDPR data processing agreement with Standard Contractual Clauses, or the UK IDTA, and our processing in Turkey follows KVKK.
What should we do after the emergency patch?
Plan the version upgrade for any branch that is out of support, run an independent verification such as a penetration test, and set up continuous vulnerability management so the next critical CVE is found and fixed quickly.
Request emergency support
Send us your site address, the platform you use (WordPress, Laravel, custom PHP, Magento and so on) and your hosting type (shared hosting, VPS, cloud or your own server). Call or message us on +90 850 335 10 87, write to info@360-soft.com, reach us on WhatsApp or use the contact page. Requests are passed to the team outside office hours too. 360 Soft Marketing Yazılım ve Danışmanlık Ltd. Şti., Nidakule Ataşehir Batı, Barbaros Mah. Begonya Sk. No:1 D:2, 34746 Ataşehir/İstanbul. More services: outsourcing services.
Sources: PHP security announcement (21 October 2026), statement of Turkey’s Cyber Security Directorate (21 October 2026), technical notes from Tenable, Wiz, InMotion Hosting and Patchstack. This page reflects the situation as of 22 October 2026 and will be updated as things develop.
