26.10.22 - [Urgent] Critical PHP Vulnerabilities "php2shell": Is Your Website Safe?

On October 21, 2026, two critical vulnerabilities in PHP were disclosed: CVE-2026-109618 and CVE-2026-109619, known together as "php2shell".

What is happening

• An unauthenticated attacker can run arbitrary code on the server (severity: Critical, CVSS 9.2).
• Almost every PHP version from 5 to 8 is affected, in any setup that serves web requests: PHP-FPM, Apache (mod_php), php-cgi, LiteSpeed and more.
• Details leaked the day before the official disclosure, and attackers are already scanning the internet for vulnerable servers.
• WordPress and any other PHP-based websites or business systems need particular attention.

What to do now

• Update PHP to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
• End-of-life PHP versions will not receive a fix — you need to move to a supported version.
• If you use shared hosting, check what your provider is doing about it.

About the MetAI website

The MetAI website (met-ai.tech) does not use PHP, so it is not affected. It is a server-less static site, and our own attack filter automatically blocks requests aimed at PHP and WordPress.

How MetAI can help

Not sure whether your site is affected, or where to start? MetAI can help with:

• Emergency check: we identify which PHP or Node.js versions your websites and apps run, and whether they are affected.
• Fixes and updates: we safely update PHP, Node.js, WordPress, plugins and libraries — and migrate end-of-life environments.
• Protection going forward: attack filters, migration to server-less static sites and monitoring for suspicious traffic, so that similar vulnerabilities in the future are far less likely to hurt you.

We can give you the same setup we use on our own site. Get in touch for a free 30-minute consultation.

Sources: Help Net Security · Tenable