Critical security advisory
PHP2Shell: update PHP now
Two critical flaws in PHP itself, together called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), can let an attacker run code on a web server without logging in. If you run a website or web application on PHP on a server you manage, including a Beriffa cloud server, update PHP now. This is not an incident at Beriffa.
What happened
On 21 October 2026 the PHP project released emergency security updates for two flaws in the PHP engine: CVE-2026-109618 (remote code execution through out-of-memory corruption) and CVE-2026-109619 (remote code execution through stale global state). The PHP project rates both as critical, with a CVSS 4.0 score of 9.2. The PHP project confirmed working attacks against both flaws, and details leaked before the planned disclosure.
Who is affected
Every server that runs PHP for websites or web applications on a version older than the fixed releases, whatever runs on top of it: WordPress, Drupal, Joomla, Magento, Laravel or your own code. The attack runs before any application code, so a login page or other checks in your site do not stop it. The PHP project confirmed attacks on Apache mod_php and PHP-FPM and names FrankenPHP and LiteSpeed as likely affected. The flaws are in PHP itself, so updating your CMS or its plugins does not fix them.
What you should do
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or install your Linux distribution's updated PHP packages, which carry the same fixes under the distribution's own version numbers (Ubuntu: USN-8948-1). Ubuntu's fixed packages, for example, still report the old PHP version, so check the package version, not php -v.
- Restart PHP afterwards (PHP-FPM, Apache or your web server). The old version keeps running until its processes restart.
- PHP 8.1 and older get no official fixed release. Move to a supported version, 8.2.35 or later, or use your distribution's backported packages where it offers them (Ubuntu does, for older releases through Ubuntu Pro).
- Running PHP in Docker? Pull the updated official php images (the 8.5.12, 8.4.27, 8.3.36 or 8.2.35 tags) and redeploy your containers.
- If your server may have been attacked before you updated, look for memory-exhaustion errors in your PHP logs, PHP processes that start shells, and PHP files you did not put there, and open a support ticket. A successful attack does not necessarily make PHP crash.
If you cannot update right away
The PHP project says there is no complete mitigation: updating is the only safe choice. Its interim measures, such as session.upload_progress.enabled=0 (and fatal_error_backtraces=0 on PHP 8.5), only reduce exposure on known attack paths and do not make a server safe. Set them in php.ini or the PHP-FPM pool configuration and restart every PHP worker.
Beriffa's own services
Beriffa's own services do not use PHP: beriffa.com and the control panel run on Cloudflare, and BERIFFA Keystone is built on .NET. Your Beriffa account and data are not affected. PHP on a cloud server is installed and managed by you, so Beriffa cannot update it for you.
Timeline
- 20 Oct 2026The PHP security team announces a critical security release. Details of the flaws leak early.
- 21 Oct 2026PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released with fixes for both flaws, and Linux distributions start shipping updated packages.
- 21 Oct 2026Beriffa publishes this advisory. We will update it if the PHP project publishes further fixes.
Official sources
For the PHP project's own advisory, the technical details and the fixed packages:
Need help?
Open a support ticket in the control panel and we will help you check your server.