Critical PHP security release (PHP2Shell): what TYPO3 site owners must do now

In short: On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), that can let an attacker run code on a server without logging in. Every TYPO3 site runs on PHP, so every TYPO3 site is affected until its server runs a patched PHP version. Updating TYPO3 alone does not help: update PHP today, or let us check it for you for free.

PHP2Shell is the name for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Under the right conditions they let an unauthenticated attacker run their own code on a web server. They were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The flaws sit in the parts of PHP that nearly every request touches: memory management and error handling. That is why they affect every PHP application, not one CMS.

Both flaws affect every runtime that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project rates the risk highest for mod_php. According to the PHP Foundation, the root cause was first noticed during an external audit in 2024. Several security firms later showed working attacks, which made the fix the team's top priority.

• 2024: an external security audit of PHP finds the first signs of the out-of-memory problem.
• 11 Aug 2026: researchers report a working remote code execution with the same root cause.
• 20 Oct 2026: the CVE IDs leak on social media; PHP brings its announcement forward.
• 21 Oct 2026, 14:00 UTC: fixed versions are released, one day earlier than planned.
• Since then: security firm watchTowr reports exploitation in the wild.

Because details leaked before the fix, attackers had a head start. Treat this as urgent.

Any server that runs PHP is affected, whatever the application: TYPO3, WordPress, Laravel or custom code. The bugs go back many years, so every PHP version is affected until it is patched.

What it means for your TYPO3 version

For PHP 7.4, 8.0 and 8.1 the PHP security team published minimal source backports for people who build PHP themselves, and some Linux distributions and LTS vendors ship backported fixes. Check with your vendor, or move to a supported PHP version. National cyber security agencies such as the UK NCSC advise taking systems offline if they cannot be fixed quickly. If your site needs more than a PHP patch, our parent company NITSAN plans and carries out the TYPO3 upgrade for you.

• Full server takeover: an attacker could read your database, steal customer data or plant malware, with no TYPO3 login needed.
• GDPR duty: a personal data breach may have to be reported to the supervisory authority within 72 hours (Art. 33 GDPR).
• Revenue and rankings: a hacked shop or company site loses sales, search visibility and trust; Google may flag it as unsafe.
• Old setups are stuck: if your TYPO3 version cannot run on PHP 8.2 or newer, you need a TYPO3 upgrade, not only a PHP update.

PHP2Shell is one more reason to harden TYPO3 itself. Our 30-point TYPO3 security checklist covers the rest.

1. Find your PHP version. In the TYPO3 backend open Admin Tools › Environment › Environment Status, check your hosting panel, or run php -v. The command-line PHP and the web server PHP can differ.
2. Compare it with the fixed versions. 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer in the same branch are safe from these two flaws. Use the PHP2Shell checker above.
3. Update PHP and restart every worker. On managed hosting, check your host's status page and ask for the update. On your own server, install your distribution's updated packages or the official release, then restart PHP-FPM or Apache so no old worker keeps running.
4. Can't update today? Reduce the risk. Apply the settings below in php.ini, the FPM pool or the Apache config, then restart every worker. Do not rely on ini_set() or .user.ini. These settings reduce the risk but do not make PHP safe.
5. Check for signs of an attack. Look for unknown PHP files in fileadmin/ and typo3temp/, new or changed backend users, memory-exhaustion errors reported as "Unknown on line 0", and PHP workers that start a shell.

Temporary settings from the PHP security advisory:

; CVE-2026-109619, all branches
session.upload_progress.enabled = 0
; CVE-2026-109619, PHP 8.5 only
fatal_error_backtraces = 0
; CVE-2026-109618 (FPM: php_admin_value)
memory_limit = -1
post_max_size = 8M   ; 32M if you need uploads

Example update on your own Debian or Ubuntu server (package names depend on your PHP source):

sudo apt update && sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm     # or: apache2 for mod_php
php -r 'echo PHP_VERSION, PHP_EOL;'
find fileadmin typo3temp -name '*.php' -newermt '2026-10-17'

Datadog Security Labs reports first attack attempts from 17 October 2026, so check your logs from that date.

T3Planet builds and supports TYPO3 templates and extensions every day, so we know which PHP versions each TYPO3 setup needs. T3Planet is the TYPO3 product brand of NITSAN GmbH, our parent company and a TYPO3 Association Gold Member. Every request is handled by NITSAN's team of more than 20 TYPO3 developers.

Remote code execution (RCE)

An attacker makes your server run their own code, which usually means full control of the site.

CVE

Common Vulnerabilities and Exposures, the public ID for a known security flaw.

CVSS

Common Vulnerability Scoring System, a 0 to 10 severity score. 9.0 and above is critical.

mod_php and PHP-FPM

Two ways a web server runs PHP. mod_php runs inside Apache; PHP-FPM runs as a separate process pool.

End of life (EOL)

A version that no longer gets security fixes, such as PHP 8.1 and older.

• php.net: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 security releases and advisory (21 Oct 2026)
• PHP Foundation: Today's PHP security release, and how we're strengthening PHP security (21 Oct 2026)
• GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• Datadog Security Labs: PHP2Shell critical vulnerabilities in PHP
• watchTowr: PHP2Shell FAQ
• UK NCSC: Critical security issue affecting PHP
• WordPress News: Critical PHP security release
• Laravel Forge: PHP security advisory

Related reading on T3Planet

• TYPO3 Security: a 30-point hardening checklist for v13 and v14
• TYPO3 update vs TYPO3 upgrade: which path to choose
• How to check TYPO3 compatibility for your next upgrade
• Automate TYPO3 upgrades with TYPO3 Rector

We update this post as new information arrives. Last update: 21 October 2026.