On October 21, 2026, the PHP development team disclosed two critical vulnerabilities — collectively referred to as PHP2Shell — that allow attackers to run unauthorized code on affected web servers. Patches are available now; details are posted at https://www.php.net/index.php#2026-10-21-5.
Website owners should take action immediately. Update your PHP environment to the latest secure release: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later). If you are running older PHP versions such as 7.4, 8.0, or 8.1, upgrade to a supported PHP release or apply any security fixes provided by your operating system vendor or hosting provider. Delaying updates could leave your website vulnerable to attacks, service disruptions, and data theft.
PHP2Shell risk assessment
Not sure if your site is affected? Use the PHP2Shell Risk Assessment Tool to quickly identify potential exposure, understand your security risk, and get guidance on the next steps to help protect your website.
Advice for users
1. Change your password if an organization whose website you use tells you it was impacted by this issue.
2. Be vigilant against scammers. Cybercriminals may take advantage of this situation. If you receive a text or email claiming a security issue and directing you to a link, don’t click it right away. Go directly to the company’s site or contact the company another way to verify.
3. Check your digital health. Make sure your apps and security software are up to date on all devices.
4. Use technology to protect yourself. Trend Micro ScamCheck can help you verify suspicious messages. Trend Micro Mobile Security (mobile) or Trend Micro Maximum Security (laptops and desktops) can help keep you safe.
