Your web host says the site is ‘up to date’. Does that mean the application, its plugins—or the PHP runtime affected by PHP2Shell? A vague answer may leave a business with false confidence.
A shop, school or small company should request the running PHP version, the patch applied, the deployment date and the checks completed. This guide explains what to ask for; it is not a remote security audit of any particular website.
What the official advisories establish
On October 21, 2026, PHP announced two critical vulnerabilities that can allow unauthenticated remote code execution under certain conditions. CVE-2026-109618 and CVE-2026-109619 concern distinct memory and internal-state problems.
The listed corrected releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP’s general advisory urges web-serving installations to update and highlights particularly high risk for Apache mod_php.