PHP2Shell Critical PHP Vulnerabilities: Cytranet Has Patched All Servers and No Customers Are Affected

Las Vegas, Nevada, October 21, 2026 — Security teams across the globe spent the day responding to one of the most serious web-server disclosures in recent memory. Today, the PHP project released emergency security updates for two critical vulnerabilities that the security community is calling PHP2Shell. Cytranet is pleased to report that we have proactively patched every server in all of our data centers that uses PHP. No Cytranet customers are affected, and all Cytranet servers are safe.

Below, we explain what was disclosed, why it matters to any business that depends on web applications, what Cytranet has done in response, and what steps every organization should take if it manages PHP servers of its own.

What Is PHP2Shell? A Plain-English Summary

PHP is one of the most widely used server-side programming languages in the world. Public reporting from security researchers indicates that it powers roughly 70 percent of all websites, including many of the most popular open-source content management systems. When a flaw is found in the PHP engine itself, rather than in a single website or plugin, the potential reach is enormous.

On October 21, 2026, the PHP security team published fixes for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Each carries a severity score of 9.2 out of 10 under the CVSS v4.0 scale, which places both firmly in the “Critical” category. According to the PHP project and the researchers who coordinated the disclosure, the flaws can allow an unauthenticated remote attacker to execute code on a vulnerable server. In plain terms, an attacker does not need a username or password to attempt to take control of an unpatched system.

Why the Flaws Are So Serious

• They live in PHP itself. The weaknesses are in the core engine, so even a very simple application running on an affected version can be exposed. A website does not need to contain a coding mistake of its own to be at risk.
• They are reachable remotely. Attackers can target them over the network without logging in first.
• They affect a very wide range of versions. Every PHP release older than the newly fixed versions is affected, including older, unsupported branches such as PHP 7 and PHP 5, according to security researchers.
• They can put sensitive data at risk. An attacker who gains control of a server may be able to reach anything stored on it or in its memory, including passwords, authentication tokens, API keys, and certificates.
• Attack activity was reported early. Details leaked a day before the coordinated release, a major cloud provider’s threat intelligence team reported an exploitation attempt against its honeypot network several days before the fixes were published, and multiple security firms reported active exploitation shortly after disclosure.

How the Vulnerabilities Work

The technical details are intricate, but the underlying theme is easy to understand. According to the published research, the bugs stem from how PHP handles fatal errors, particularly out-of-memory conditions, while it is processing a web request. When such an error interrupts a request at exactly the wrong moment, PHP can leave behind stale, corrupted internal state. A later request handled by the same worker can then reuse that leftover state, which can result in memory corruption that an attacker is able to steer. Both issues are classified as use-after-free weaknesses.

CVE-2026-109618

This vulnerability allows remote code execution through out-of-memory corruption. When PHP runs out of memory while request data is only partly initialized, its cleanup routine can treat that incomplete data as valid, corrupting memory in a way an attacker can exploit.

CVE-2026-109619

This vulnerability allows remote code execution through stale global state. In a long-running PHP worker, state that belongs to one request can outlive the memory it points to, and a later request handled by the same worker can then use that freed memory. Researchers report that this can also be turned into unauthenticated code execution.

The PHP project addressed both issues with a single root-cause fix that prevents state corruption when a request is interrupted by a fatal error. The only complete remediation is to update PHP to a fixed release.

Which PHP Versions Contain the Fixes?

The PHP project released the following patched versions on October 21, 2026:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Minimal source-code backports have also been made available for PHP 7.4, 8.0, and 8.1, and several operating system vendors are shipping patched packages for their own builds. PHP 7.3 and older releases are affected but will not receive fixes, so organizations running them should plan a migration to a supported PHP branch as soon as practical.

Cytranet Has Proactively Patched Every PHP Server in Every Data Center

Protecting our customers’ communications and data is the core of what we do. Cytranet is a licensed telecommunications carrier that provides internet, voice, and data services to businesses, nonprofits, and government customers, and we operate our own data centers in Las Vegas, Los Angeles, Phoenix, Dallas, and Chicago. Our engineering team treated today’s disclosure as a top priority from the moment it became public.

Here is what that means for you:

• All PHP-based servers are patched. Every Cytranet server in every one of our data centers that uses PHP has been updated.
• No Cytranet customers are affected. Our review found no customer impact from these vulnerabilities.
• All Cytranet servers are safe. Our infrastructure is protected against both CVE-2026-109618 and CVE-2026-109619.
• No action is required from you. Customers who use Cytranet-managed services do not need to change settings, rotate credentials, or install anything as a result of this disclosure.

“When a flaw in a core technology like PHP is disclosed, our responsibility is to act immediately and to be transparent about the result. I am glad to confirm that we have patched every PHP-based server across all of our data centers, that no Cytranet customers are affected, and that our servers are safe. Customers trust us with systems their businesses rely on every day, and we do not take that trust lightly.”

— Doug Roberts, Manager and CTO, Cytranet

Why Fast Patching Matters for Business Networks

For a business, a flaw like PHP2Shell is not only an IT concern. A compromised web server can lead to stolen credentials, exposed customer records, defaced websites, malware distribution, and costly downtime. Attackers also tend to move quickly once exploit details are public, which is why the gap between disclosure and patching matters so much.

This is one of the reasons reliable infrastructure is so valuable. When your internet connectivity, hosted voice platform, colocation environment, and managed network are all operated by a carrier that stays on top of security events, you gain an extra layer of confidence. Cytranet provides dedicated fiber internet, fixed wireless and microwave internet, VoIP and hosted PBX services, SIP trunking, private data transport, colocation and data center hosting, and managed Wi-Fi, all delivered with a focus on dependability for business and government customers nationwide.

What Should Other Organizations Do Right Now?

If your organization manages its own PHP servers, whether on premises, in a data center, or in the cloud, we encourage you to act promptly. The following steps reflect the guidance being shared by PHP and the wider security community.

1. Update PHP Everywhere

Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the branch you run. Remember to include every environment: production servers, staging systems, container images, and automated deployment pipelines. If you rely on a hosting provider or an operating system vendor, confirm when their patched packages will be available, because some distributions publish updates after the official release.

2. Apply Interim Mitigations If You Cannot Patch Immediately

The PHP project listed configuration changes that reduce exposure while an update is being scheduled, including setting session.upload_progress.enabled = 0 and restarting PHP, which it associated with CVE-2026-109619. Other security vendors have also suggested limiting or temporarily blocking multipart form uploads at the web server or firewall layer, or placing vulnerable sites into a read-only state, until the update can be applied. Researchers caution that no configuration change fully mitigates these vulnerabilities, so these measures are not a substitute for patching.

3. Review Logs for Unusual Activity

Because these flaws operate beneath the application layer, ordinary application logs may show little. Security researchers suggest watching for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unexpectedly large or malformed session cookies, and unexplained PHP worker restarts.

4. Update Your Web Application Firewall Rules

Several major network and security providers have released protective rules for these vulnerabilities. If you use a web application firewall or a content delivery network, make sure the latest rule sets are enabled.

5. Protect Your Credentials

Because a successful attack can give an intruder access to a server’s secrets, organizations that may have been exposed should consider rotating passwords, tokens, API keys, and certificates after patching.

Lessons From PHP2Shell: Security Is a Continuous Process

Disclosures like this one are a reminder that cybersecurity is not a one-time project. It is a daily discipline that includes maintaining an accurate inventory of the software you run, applying updates quickly, limiting what is exposed to the internet, monitoring for suspicious behavior, and planning for the unexpected. Security experts have also noted that modern AI tools are lowering the barrier to turning long-hidden software flaws into working exploits, which suggests that defenders will need to patch faster than ever before.

Cytranet will continue to monitor developments related to PHP2Shell, including any additional guidance from the PHP project, and will keep our customers informed if anything changes.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name the security community is using for two critical vulnerabilities in the core PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619, that were publicly fixed on October 21, 2026. They can allow unauthenticated remote code execution on vulnerable servers.

Are Cytranet customers affected by the PHP vulnerabilities?

No. Cytranet has proactively patched all servers in all of its data centers that use PHP, no Cytranet customers are affected, and all Cytranet servers are safe.

Do Cytranet customers need to take any action?

No action is required. Customers of Cytranet-managed services do not need to change settings or install updates as a result of this disclosure. If you operate your own PHP servers, including colocated equipment that you manage yourself, you should apply the PHP updates described above.

Which PHP versions are fixed?

The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Backports are available for PHP 7.4, 8.0, and 8.1, while PHP 7.3 and older will not be fixed, so organizations on older versions should plan to upgrade to a supported branch.

Is updating PHP the only way to fix the problem?

Yes, updating is the only complete fix. Disabling session upload progress and restricting multipart uploads can reduce exposure in the short term, but no configuration change fully removes the underlying flaws.

Where can I get help securing my business network?

Cytranet’s team is available to discuss secure connectivity, colocation, hosted voice, and managed network services for your organization. Contact us using the details below.

Contact Cytranet

Cytranet is a Las Vegas-based fiber-optic internet service provider and licensed telecommunications carrier serving business, nonprofit, enterprise, and government customers nationwide. If you have questions about today’s PHP security disclosure, or if you would like to learn how Cytranet can support your organization’s connectivity and infrastructure, we would be glad to hear from you.

Phone: 702-846-5000
Email: info@cytranet.com