On 20 and 21 October 2026, two critical security flaws in PHP were made public. They are nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10.

The flaws let an attacker take over a server that runs PHP with a single request, without logging in.

Details leaked before the fix was ready, and early attack attempts were reported within hours.

PHP released fixes on 21 October 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sites that run PHP need to update.

Mythox does not use PHP anywhere: not in the web app, the website, the Mac app, the iPhone app or the server code.

We still checked:

• Our code. None of the poisoned code packages reported in other attacks this month are in Mythox. The tools that build and check our code are locked to exact, known versions.
• Where our code is stored. None of the planted password-stealing files reported in another attack this month are there.
• Our server. No PHP and no sign of anyone getting in. Only our own key can open it, and it is closed to everything it does not need.
• The services behind your account. We checked the main services that hold member accounts, work and payments. None of them have reported being affected.
• Your card. Card payments are handled by Stripe. Mythox never stores card numbers.

• OpenAI and Anthropic. Mythox's security work is approved in the security programs of OpenAI and Anthropic. Those programs give us their strongest models, including Anthropic's Mythos, to check our own systems for weak spots.
• The newest models. We also use the newest models from Google and OpenAI, such as Argon and Astra, to review our code and our plans.
• Watched around the clock. Automatic watchers alert the team the moment something looks wrong with payments, sign-ups, support or server health.
• Checked sign-ups. New sign-ups pass a human check, and members can turn on two-step sign-in in their security settings.
• A full review. This week we also started a full review of every login, key and setting behind Mythox, on top of these checks.

• Turn on two-step sign-in in Mythox security settings.
• Use a password you do not use anywhere else.
• Mythox will never ask for your password by email. If an email or a site asks for it, it is not us.

Questions? Reply to any Mythox email or write to support@mythox.ai.

• The fix is out. Nothing new has been released since 21 October. Anyone running PHP 8.5, 8.4, 8.3 or 8.2 should update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
• Attack attempts are real and heavy. Amazon reported the first attempt on 17 October, four days before the fix. Cloudflare's chief executive described millions of attempts after the flaws went public. The Register reported both on 22 October.
• Proven damage is still thin. No company has been publicly named as a victim, and one security firm withdrew an earlier claim of a successful break-in. On 22 October, the Dutch national cyber security centre said it is looking into first signs of successful misuse.
• The biggest risk is old PHP, and products with PHP built in. Versions 8.1 and older get no official fix. The plain advice from governments in the US, UK, EU and Japan: update now, ask the product's maker, or take the system offline until it can be fixed.
• If you cannot update today. PHP's own advice is a temporary setting change, which it says is not a full fix.
• What to watch next. Whether the US cyber agency adds these flaws to its list of flaws used in real attacks, the next regular PHP release, fixes from product makers, and any first confirmed victim.