Severity: Critical
Date: October 21, 2026
Security researchers have identified a critical vulnerability in PHP, a widely used web application programming language.
Immediate Action to Take
Customers using PHP for websites, applications, and/or APIs must immediately update their PHP version to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. These PHP versions were released October 21st, and any prior PHP versions may be vulnerable.
WordPress sites are a major, widely adopted platform leveraging PHP for websites.
• Work with the team who supports your websites/applications to determine if PHP is used
• If PHP is used, patch immediately to the appropriate fixed version released today (8.5.12, 8.4.27, 8.3.36, or 8.2.35)
• If a patch is not possible (some hosting platforms have yet to release patches), take the site offline or restrict site access to only known/trusted IP addresses until patching is possible
• Manual mitigations are surfacing, but those mitigations break website functionality, do not provide 100% coverage across these vulnerabilities, and are not recommended
Please reach out to your Drawbridge team if you have additional questions or need assistance working with your web host or website administrator.
Background
PHP powers approximately 70% of websites that utilize a known server-side scripting language, making this one of the most broadly impactful internet security issues disclosed in recent years.
The vulnerability, referred to publicly as “PHP2Shell,” could allow attackers to achieve remote code execution (RCE) on vulnerable PHP servers, potentially enabling unauthorized system access, malware deployment, website compromise, data theft, credential harvesting, and further lateral movement within corporate environments.
Researchers and industry partners have already released security updates, and government cybersecurity agencies globally are urging organizations to patch affected systems immediately.
Reference: https://www.php.net/archive/2026.php#2026-10-21-5
