PHP shipped an emergency release on 21 October after two flaws were found to allow unauthenticated remote code execution. Turkey's Cyber Security Presidency issued a national advisory the same day.
The PHP development team shipped an unscheduled emergency security release on 21 October 2026. The two vulnerabilities, collectively known as "PHP2Shell" and tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution without any authentication. Arctic Wolf rates both as critical, each scoring 9.2 on CVSS 4.0. In Turkey, the Cyber Security Presidency published a national-scale advisory the same day, available at siberguvenlik.gov.tr under reference tr-26-1372.
Why this one is different
The weakness is not in your application code — it sits in PHP's own request-handling lifecycle. According to Palo Alto Networks Unit 42, CVE-2026-109618 stems from request memory being left partially initialised when an out-of-memory condition interrupts processing, while CVE-2026-109619 involves global state pointing to freed memory after a fatal error, which a later request can then reuse.
The practical consequence is blunt: however carefully your site was written, the exposure remains. Arctic Wolf lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as affected, along with appliances that bundle PHP internally. Apache mod_php carries the highest risk, because exploitation can reportedly happen on a single unauthenticated request before application code runs at all.
Patch status and what the internet looks like
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The catch is that PHP 8.1 and earlier are end of life and will receive no upstream fix. In a Shodan sweep reported by The Hacker News, measurement firm Mallory found that as of 20 October roughly 59% of about 1.5 million internet-facing hosts reporting a PHP version — around 884,000 systems — were still advertising PHP 8.1 or older. Those are banner counts, not confirmed vulnerable systems, but they show how widespread unsupported builds remain.
Unit 42's 29 October update reports active exploitation against internet-exposed PAN-OS management interfaces. Arctic Wolf observed widespread scanning and exploit-validation traffic shortly after disclosure and notes that public proof-of-concept code exists, while adding that reliable exploitation at scale has so far been comparatively limited.
What it means for small and mid-sized businesses
Corporate websites, e-commerce platforms, dealer portals and customer panels at Turkish SMEs run predominantly on PHP — WordPress and OpenCart included. On shared hosting it may look as though the provider owns the PHP version, but most control panels hand that choice to the customer, so "the host has probably dealt with it" is not a safe assumption. Companies running their own servers or VPS instances carry the responsibility entirely.
There is a second layer of risk inside the network: a web server taken over this way can become the pivot point into the file or accounting server beside it, and a breach involving personal data triggers notification obligations under Turkish data protection law.
What Kamer Bilişim recommends
- Inventory first, then schedule the patch. List every PHP version across your web servers, VPS instances and hosting panels, including builds embedded inside appliances. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 needs updating — and restart PHP worker processes afterwards, or the old code stays loaded.
- Take management interfaces off the public internet. Server, firewall and panel interfaces rarely need to be reachable by everyone. Put them behind a VPN or restrict them to known IP addresses — the active exploitation Unit 42 reported had exactly this in common.
- Set a deadline for leaving unsupported PHP builds. Systems on PHP 8.1 or earlier get no upstream fix here. Unless your distribution vendor ships a backported package, plan the migration to a supported branch — and because it needs testing, do it in a planned window, not an emergency one.
If you are not certain which PHP versions run on your servers, or would rather have the patch plan drawn up in one pass, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Arctic Wolf, Palo Alto Networks Unit 42, The Hacker News, Cyber Security Presidency of Türkiye (advisory tr-26-1372)
Source: Arctic Wolf