On 21 October 2026, the PHP Project released urgent security updates to address two critical remote code execution (RCE) vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619.

Collectively referred to as PHP2Shell, these vulnerabilities affect PHP itself, a widely used technology powering WordPress, Magento, Joomla, many e-commerce platforms, and countless custom web applications used worldwide. If you haven't noted the issue and taken action yet, now is the time.

Access our security partner Blackpoint Cyber's detailed technical analysis here: https://blackpointcyber.com/blog/php2shell-cve-2026-109618-cve-2026-109619/

Both vulnerabilities carry a CVSS v4.0 severity rating of 9.2 out of 10, meaning they are critical.

More concerning is that exploit code has already been made public, and multiple security vendors, including Cloudflare, have reported early exploitation activity.

If you're running websites, customer portals, internal applications, or software built on PHP, this is not a vulnerability that can wait until the next maintenance window.

What Is PHP2Shell?

Unlike many security incidents that affect a specific application or plugin, PHP2Shell affects the PHP runtime itself.

The distinction is important.

Updating WordPress plugins, themes, or application code does not address the issue. Vulnerable systems must have PHP itself updated to a patched version.

If successfully exploited, the vulnerabilities could allow attackers to remotely execute commands on vulnerable servers without valid credentials. Security researchers have demonstrated exploitation against common PHP deployments, and PHP's own advisory highlights Apache mod_php environments as particularly exposed.

The vulnerabilities impact installations serving web traffic, including:

• WordPress websites
• Magento and e-commerce platforms
• Customer portals
• Intranet applications
• Custom PHP applications
• Hosting environments using PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
• Identifying managed systems running vulnerable PHP versions
• Applying updates where PHP is directly supported under Lancom management
• Working with infrastructure, hosting and software partners to coordinate patching
• Proactively contacting affected customers
• Monitoring supported environments for indicators of compromise.

Who is affected?

Potentially, a very large portion of the internet. The simple advice here is if you use, or suspect you use PHP anywhere, check, verify, and patch,

PHP is one of the world's most widely deployed web technologies. Because these vulnerabilities exist in the underlying runtime rather than a specific application, even otherwise secure websites may be at risk if they are running a vulnerable PHP version.

Organisations running PHP 8.1 or older face an additional challenge because those versions are no longer officially supported and do not receive normal security releases.

What Lancom Technology is doing

As soon as the vulnerability details became available, Lancom began reviewing managed customer environments to identify affected systems and coordinate remediation activities.

This includes:

• Identifying managed systems running vulnerable PHP versions
• Applying updates where PHP is directly supported under Lancom management
• Working with infrastructure, hosting and software partners to coordinate patching
• Proactively contacting affected customers
• Monitoring supported environments for indicators of compromise.

Our security partner, Blackpoint Cyber, is also actively monitoring managed environments for suspicious activity associated with exploitation attempts.

What you should do now

One of the biggest challenges with PHP vulnerabilities is that many do not know where PHP is actually being used. Many websites and applications are routinely managed externally, so if you are unsure if your organisation uses PHP, now is the time to ask.

Specifically, confirm if websites or applications use PHP, which version is currently installed, and if it is affected by CVE-2026-109618 or CVE-2026-109619. If so, request confirmation of application of the necessary update, and if testing is required before deployment.

The only real fix

The PHP maintainers are clear: there is no complete workaround. While temporary mitigations may reduce risk, the only supported remediation is updating PHP to a confirmed fixed release.

Systems running unsupported releases should be upgraded or have external exposure restricted until remediation can occur.

Final thoughts

PHP2Shell is a reminder that some of the most significant security risks do not originate in applications themselves, but in the technology foundations they depend on. Many will assume they are unaffected because they do not actively develop in PHP. In reality, a website, plugin, customer portal, hosted application, or even a forgotten legacy system may be relying on it.

The challenge now is visibility. Those who at know where PHP exists in their environment can patch quickly. Those that don't are left exposed.

If unsure whether your organisation has affected systems, now is the time to ask. Please contact your CSM, our New Zealand Service Desk on (+64) 09 377 8282 or our Australian Service Desk on (+61) 1300 941 875 if you need more information or assistance.