Las Vegas, Nevada, October 21, 2026 — Security teams across the globe spent the day responding to one of the most serious web-server disclosures in recent memory. Today, the PHP project released emergency security updates for two critical vulnerabilities that the security community is calling PHP2Shell. Cytranet is pleased to report that we have proactively patched every server in all of our data centers that uses PHP. No Cytranet customers are affected, and all Cytranet servers are safe.
Below, we explain what was disclosed, why it matters to any business that depends on web applications, what Cytranet has done in response, and what steps every organization should take if it manages PHP servers of its own.
What Is PHP2Shell? A Plain-English Summary
PHP is one of the most widely used server-side programming languages in the world. Public reporting from security researchers indicates that it powers roughly 70 percent of all websites, including popular content management systems such as WordPress, Drupal, and Joomla. When a flaw is found in the PHP engine itself, rather than in a single website or plugin, the potential reach is enormous.
On October 21, 2026, the PHP security team published fixes for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Each carries a severity score of 9.2 out of 10 under the CVSS v4.0 scale, which places both firmly in the “Critical” category. According to the PHP project and the researchers who coordinated the disclosure, the flaws can allow an unauthenticated remote attacker to execute code on a vulnerable server. In plain terms, an attacker does not need a username or password to attempt to take control of an unpatched system.
Why the Flaws Are So Serious
- They live in PHP itself. The weaknesses are in the core engine, so even a very simple application running on an affected version can be exposed. A website does not need to contain a coding mistake of its own to be at risk.
- They are reachable remotely. Attackers can target them over the network without logging in first.
- They affect a very wide range of versions. Researchers report that PHP releases going back to version 5.4 are affected by at least one of the issues.
- They can expose sensitive data. Beyond code execution, one of the flaws can leak the contents of a PHP worker’s memory, which may include passwords, authentication tokens, API keys, and certificates.
- Attack activity was reported early. Details leaked before the scheduled release, and a major internet infrastructure provider reported early attack attempts on the morning of the disclosure.
How the Vulnerabilities Work
The technical details are intricate, but the underlying theme is easy to understand. According to the published research, the bugs stem from how PHP handles fatal errors, particularly out-of-memory conditions, while it is processing a web request. When such an error interrupts a request at exactly the wrong moment, PHP can leave behind stale, corrupted internal state. A later request handled by the same worker can then reuse that leftover state, which can result in memory disclosure or memory corruption that an attacker is able to steer.
CVE-2026-109618
This vulnerability involves the way PHP handles session upload-progress data when it processes multipart form uploads. A fatal error during that step can leave a dangling reference behind, and a subsequent request can be manipulated to read or corrupt memory. Researchers demonstrated both unauthenticated remote memory disclosure and pre-authentication code execution against widely used content management systems.
CVE-2026-109619
This vulnerability involves a stale reference left behind after a fatal error, as well as a type-confusion problem in OPcache, the component that stores compiled PHP code in shared memory. Researchers demonstrated that these weaknesses could be chained into unauthenticated code execution as well.
Importantly, the researchers noted that the patch released by the PHP team addresses the root cause and is intended to eliminate the related variants they identified. The only complete remediation is to update PHP to a fixed release.
Which PHP Versions Contain the Fixes?
The PHP project released the following patched versions on October 21, 2026:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Because older branches are also affected, organizations running PHP 8.1 or earlier should consult their operating system vendor or hosting provider for backported fixes, and should plan a migration to a supported PHP branch as soon as practical.
Cytranet Has Proactively Patched Every PHP Server in Every Data Center
Protecting our customers’ communications and data is the core of what we do. Cytranet is a licensed telecommunications carrier that provides internet, voice, and data services to businesses, nonprofits, and government customers, and we operate our own data centers in Las Vegas, Los Angeles, Phoenix, Dallas, and Chicago. Our engineering team treated today’s disclosure as a top priority from the moment it became public.
Here is what that means for you:
- All PHP-based servers are patched. Every Cytranet server in every one of our data centers that uses PHP has been updated.
- No Cytranet customers are affected. Our review found no customer impact from these vulnerabilities.
- All Cytranet servers are safe. Our infrastructure is protected against both CVE-2026-109618 and CVE-2026-109619.
- No action is required from you. Customers who use Cytranet-managed services do not need to change settings, rotate credentials, or install anything as a result of this disclosure.
“When a flaw in a core technology like PHP is disclosed, our responsibility is to act immediately and to be transparent about the result. I am glad to confirm that we have patched every PHP-based server across all of our data centers, that no Cytranet customers are affected, and that our servers are safe. Customers trust us with systems their businesses rely on every day, and we do not take that trust lightly.”
— Doug Roberts, Manager and CTO, Cytranet
Why Fast Patching Matters for Business Networks
For a business, a flaw like PHP2Shell is not only an IT concern. A compromised web server can lead to stolen credentials, exposed customer records, defaced websites, malware distribution, and costly downtime. Attackers also tend to move quickly once exploit details are public, which is why the gap between disclosure and patching matters so much.
This is one of the reasons reliable infrastructure is so valuable. When your internet connectivity, hosted voice platform, colocation environment, and managed network are all operated by a carrier that stays on top of security events, you gain an extra layer of confidence. Cytranet provides dedicated fiber internet, fixed wireless and microwave internet, VoIP and hosted PBX services, SIP trunking, private data transport, colocation and data center hosting, and managed Wi-Fi, all delivered with a focus on dependability for business and government customers nationwide.
What Should Other Organizations Do Right Now?
If your organization manages its own PHP servers, whether on premises, in a data center, or in the cloud, we encourage you to act promptly. The following steps reflect the guidance being shared by PHP and the wider security community.
1. Update PHP Everywhere
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the branch you run. Remember to include every environment: production servers, staging systems, container images, and automated deployment pipelines. If you rely on a hosting provider or an operating system vendor, confirm when their patched packages will be available, because some distributions publish updates after the official release.
2. Apply Interim Mitigations If You Cannot Patch Immediately
The PHP project advised that setting session.upload_progress.enabled = 0 and restarting PHP blocks one of the attack paths associated with CVE-2026-109619. Other security vendors have also suggested limiting or temporarily blocking multipart form uploads at the web server or firewall layer, or placing vulnerable sites into a read-only state, until the update can be applied. These measures reduce exposure but are not a substitute for patching.
3. Review Logs for Unusual Activity
Because these flaws operate beneath the application layer, ordinary application logs may show little. Security researchers suggest watching for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unexpectedly large or malformed session cookies, and unexplained PHP worker restarts.
4. Update Your Web Application Firewall Rules
Several major network and security providers have released protective rules for these vulnerabilities. If you use a web application firewall or a content delivery network, make sure the latest rule sets are enabled.
5. Protect Your Credentials
Because one of the flaws can disclose memory contents, organizations that may have been exposed should consider rotating passwords, tokens, API keys, and certificates after patching.
Lessons From PHP2Shell: Security Is a Continuous Process
Disclosures like this one are a reminder that cybersecurity is not a one-time project. It is a daily discipline that includes maintaining an accurate inventory of the software you run, applying updates quickly, limiting what is exposed to the internet, monitoring for suspicious behavior, and planning for the unexpected. Researchers also noted that modern AI tools are lowering the barrier to turning long-hidden software flaws into working exploits, which suggests that defenders will need to patch faster than ever before.
Cytranet will continue to monitor developments related to PHP2Shell, including any additional guidance from the PHP project, and will keep our customers informed if anything changes.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name the security community is using for two critical vulnerabilities in the core PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619, that were publicly fixed on October 21, 2026. They can allow unauthenticated remote code execution on vulnerable servers.
Are Cytranet customers affected by the PHP vulnerabilities?
No. Cytranet has proactively patched all servers in all of its data centers that use PHP, no Cytranet customers are affected, and all Cytranet servers are safe.
Do Cytranet customers need to take any action?
No action is required. Customers of Cytranet-managed services do not need to change settings or install updates as a result of this disclosure. If you operate your own PHP servers, including colocated equipment that you manage yourself, you should apply the PHP updates described above.
Which PHP versions are fixed?
The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations on older versions should seek backported fixes from their vendors and plan to upgrade to a supported branch.
Is updating PHP the only way to fix the problem?
Yes, updating is the only complete fix. Disabling session upload progress and restricting multipart uploads can reduce exposure in the short term, but they do not remove the underlying flaws.
Where can I get help securing my business network?
Cytranet’s team is available to discuss secure connectivity, colocation, hosted voice, and managed network services for your organization. Contact us using the details below.
Contact Cytranet
Cytranet is a Las Vegas-based fiber-optic internet service provider and licensed telecommunications carrier serving business, nonprofit, enterprise, and government customers nationwide. If you have questions about today’s PHP security disclosure, or if you would like to learn how Cytranet can support your organization’s connectivity and infrastructure, we would be glad to hear from you.
Phone: 702-846-5000
Email: info@cytranet.com
Talk to Cytranet
A business-only carrier for fiber internet, cloud voice, managed Wi-Fi, and managed IT. Start with a free technology evaluation.
