Operations | Monitoring | ITSM | DevOps | Cloud

The detailed flaw coined “php2shell” is inherent in the PHP language itself, with multiple versions of PHP affected that have been released on the last decade. Ryan Austin, a Calif researcher who helped uncover the issue told the BBC it was, “The most serious vulnerability I’ve ever found". Wiz wrote in a blog post about the detailed findings that would allow hackers to exploit the PHP2Shell issue and take control of an affected web server.

When a critical flaw surfaces in the language behind a large share of your web applications, how quickly can your organization name every server that runs it? PHP2Shell puts that question in front of every IT leader who runs PHP. The answer decides how long the business stays exposed. Here's the short version. PHP2Shell covers two flaws in the PHP engine, and either one lets an attacker run code on a web server with no login at all.

On 21 October 2026, the team behind PHP released an emergency fix for two critical security flaws. PHP is the programming language behind a large share of the web, including WordPress, Drupal and many online stores. Researchers at Wiz named the flaws PHP2Shell. An attacker could use them to take control of a website without ever logging in. Updating a website, its CMS, or its plugins doesn't help. The only real fix is (and was) a new version of PHP itself.

Last updated: October 21, 2026. We'll update this article as PHP and Linux distributions publish new information. PHP2Shell is the nickname of two critical vulnerabilities in PHP that let an attacker run code on a web server without logging in. PHP released the fixes on October 21, 2026, and IT and security teams now need to know which of their servers and computers run a vulnerable PHP version, so they can patch those first.

On October 20th, 2026, the PHP Security Team issued an advanced notice and security advisory disclosing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS v4.0 9.2, affecting PHP installations.

CVE-2026-74580 is a high-severity Linux kernel bug in vhost, the subsystem that accelerates I/O for virtual machines. It gives a local user a reliable path to root on the host, and in some VM setups it lets a guest write into host memory. The CVE record has existed since August 21, 2026, but the full technical write-up, nicknamed "Vghost", only went public on October 12. It came with working exploit demos for both a local root escalation and a VM escape.

On 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high (CVE-2026-92392), while the others have a low or medium severity. The curl maintainer has coordinated with downstream vendors, including Ubuntu, under embargo and the vulnerabilities have been publicly disclosed on the planned date.

Avantra monitors SAP security patch status across entire landscapes, checking each newly published SAP HotNews note against every managed system and tracking which systems still need it. It covers the patch side of SAP vulnerability management, which is a different job from code-level vulnerability scanning.

✓ operational truth Operational risk is no longer limited by the ability to find vulnerabilities. It is limited by the ability to prioritize them by business exposure and to act on the large share that cannot be patched at all. Autonomous IT changes this by mapping findings to applications and owners, automating the work around the patch, and proposing evidenced mitigations where no patch exists.