PHP is the programming language behind almost 7 out of 10 websites, from blogs and online stores to corporate portals. It’s so widespread that people rarely give it a second thought. Until something breaks.
On Wednesday, October 21, two critical PHP vulnerabilities dubbed PHP2Shell were disclosed, allowing attackers to execute code on servers remotely. The alert quickly went global, with millions of websites and web applications affected.
The threat was serious enough that the NSA advised any site unable to patch the flaw to take itself offline temporarily.
In this article, we explain what PHP2Shell is, how to fix it, and how we at Latinia confirmed that none of our vendors had been exposed.
What is the PHP2Shell vulnerability?
PHP is the programming language that powers almost 7 out of 10 websites, including those built on WordPress, Drupal and Joomla.
PHP2Shell covers two flaws in the PHP engine itself, tracked as CVE-2026-109618 and CVE-2026-109619. CVEs (Common Vulnerabilities and Exposures) are the public identifiers assigned to each known vulnerability.
As INCIBE (Spain’s National Cybersecurity Institute) has warned, these flaws allow an unauthenticated attacker to run code directly on the server and take full control of it with a single request. Both are rated 9.2 out of 10 on the CVSS (Common Vulnerability Scoring System), the industry standard for measuring how severe a vulnerability is.
How to fix it
The only definitive fix is to update PHP. The PHP team makes this clear in its official security advisory: configuration changes reduce the risk, but none of them fully close the vulnerability.
The fixes ship in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one for each supported branch. PHP 8.1 and earlier versions no longer receive official updates. Given how severe the flaw is, the PHP team has released minimal patches for 7.4, 8.0 and 8.1, intended for those who compile PHP from source.
One key point if you run a WordPress site: updating WordPress, your theme or your plugins won’t fix the flaw. The vulnerability lives in the PHP installed on the server, not in the application.
How Latinia responded
Our products don’t use PHP. No Latinia product includes PHP in its code or relies on it to run. That means neither our solutions nor our clients’ deployments were vulnerable at any point.
Our vendors, fully up to date. As soon as the first alert came out, we reached out to the vendors and SaaS (software as a service) applications we use that run on PHP. Every one of them confirmed they had already applied the patched version. Verification was complete in under 4 hours.
Our corporate website, protected from day one. www.latinia.com runs on WordPress, and therefore on PHP. Cloudflare, our edge security provider, blocked attempts to exploit the vulnerability from the very start. On October 21 itself, just hours after the patch was released, the site was updated and verified. The full review of all our systems wrapped up the following morning, with no sign of any intrusion.
Whenever a vulnerability makes the headlines, emails start appearing that use it as a pretext to ask for passwords or “urgent” downloads. If a message asks you for credentials, to download files or to install patches, always verify where it came from through an official channel before acting.
Security also depends on your supply chain
A vulnerability like PHP2Shell tests more than your own code: it tests whether you know what technology each vendor uses and can verify it within hours. For a financial institution, that visibility is part of vendor and channel governance and of operational resilience and service continuity, two pillars of our approach to security and regulatory compliance.
If you have any questions about PHP2Shell, your usual Latinia contact is here to help.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name given to two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and disclosed on October 21, 2026. Both are rated 9.2 out of 10 on the CVSS scale and let an attacker take over a server with a single request, no username or password required. They affect any unpatched PHP installation that handles web requests.
How do you fix the PHP2Shell vulnerability?
By updating PHP to a patched version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch you use. This is the only complete fix; configuration changes and firewalls only reduce the risk. After updating, PHP processes must be restarted so the server loads the new version. PHP 8.1 and earlier versions no longer receive official updates.
Does updating WordPress protect against PHP2Shell?
No. The vulnerability is in PHP, the language WordPress runs on, not in WordPress itself. Updating WordPress, your theme or your plugins won’t fix the flaw: you need to update the PHP version installed on the server. If your site is on managed hosting, it’s worth confirming with your provider that the patch has been applied.
Have Latinia’s solutions been affected by PHP2Shell?
No. No Latinia product includes PHP in its code or relies on it to run, so neither its solutions nor its clients’ deployments were vulnerable at any point. The SaaS vendors Latinia uses that run on PHP confirmed in under 4 hours that they had already applied the patched version.
Do Latinia clients need to take any action on PHP2Shell?
No action is required from clients: Latinia’s services continue to run as normal. Latinia will never ask for passwords, or ask you to install patches or download files, in connection with this vulnerability. If you have any questions or receive a suspicious message, contact your usual Latinia contact.
