PHP2Shell: Two Critical PHP Flaws, Emergency Patches and What Website Owners Should Do

On 21 October 2026 the PHP project released emergency security updates for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The flaws, nicknamed "PHP2Shell" by researchers and the press, can allow an attacker to run code on a web server without logging in. This article summarizes what is confirmed, what is disputed and what to do. It will go out of date quickly, so check the sources at the end for the latest information.

What happened

On 20 October the PHP team announced that a critical security release was planned for the next day. According to security firm Huntress, details of the flaws leaked the same day, and another firm, watchTowr, confirmed the leak was genuine. PHP published the fixes on 21 October.

What PHP says

According to the PHP project's own announcement:

• Both vulnerabilities can allow unauthenticated remote code execution.
• Both are rated 9.2 on the CVSS v4.0 scale, which is critical. (Qualys also reports 9.2 for each.)
• CVE-2026-109618: out-of-memory handling can interrupt PHP while request data is only partly set up, and the cleanup that follows may treat that invalid data as valid.
• CVE-2026-109619: request-owned internal state can survive after its memory is freed, so a later request on the same worker may use stale data.
• All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project sees the highest risk in mod_php, where a demonstrated exploit can trigger the attack before any application code runs.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Who is affected

PHP is widely used. Wiz Research estimates that it powers roughly 70% of websites, which does not mean that 70% of websites are vulnerable. Google Cloud says PHP versions from 5.4 through 8.5.11 are affected. Researchers cited by Newsweek say they demonstrated remote code execution against WordPress, Drupal and Joomla, among other PHP-based applications, and Wikimedia said its PHP systems were affected.

PHP 8.1 and older no longer receive updates from the project. Some Linux distributions and long-term-support vendors provide backported fixes. PHP also published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. Reports differ on how far this covers older versions, so check with your vendor.

Is it being exploited?

Reports conflict, and the picture is changing. Qualys says exploitation attempts have been observed, citing Amazon Threat Intelligence and Cloudflare. Help Net Security reports that an Amazon honeypot recorded an attempt on 17 October, four days before disclosure. Patchstack's telemetry showed probing without hard evidence of breaches, while Huntress said it had not seen exploitation among its own partners. Several outlets reported that some government and local-government sites in Europe were taken offline as a precaution. Those reports are second-hand. We found no confirmed account of a large-scale compromise in the sources we reviewed.

What website owners should do

1. Update PHP to one of the fixed versions, or install your vendor's patched package. PHP says only an update is a complete fix.
2. Do not stop at WordPress, plugins or themes. Automattic noted that updating them does not fix the underlying PHP flaw.
3. Take stock of every PHP installation, including staging sites, containers and software bundled in vendor products.
4. If you cannot update right away, PHP lists interim measures, such as disabling session upload progress and limiting request sizes. It states that they reduce exposure but do not make an installation safe. Authorities in Europe and the NSA have advised taking affected systems offline if they cannot be patched.
5. Treat a server as possibly compromised if you see signs of attack, and rotate the credentials it holds, because the flaws can also expose memory contents.
6. Beware of "fix" plugins and copied snippets from unofficial sources.

What ordinary users can do

There is nothing for you to patch yourself. Press reports recommend the usual precautions: unique passwords, multifactor authentication, and caution with unexpected login or password-reset messages, which can follow incidents like this one.

What is still unclear

• How many systems are actually exposed or compromised.
• The exact range of affected versions, which sources describe differently.
• How attackers obtained the details before disclosure.
• How far the fixes for old, unsupported versions go.

Sources: the PHP project's security announcement (php.net), the CVE advisories on GitHub, Qualys, Help Net Security, Patchstack, Huntress, Google Cloud, BleepingComputer, Newsweek and Deseret News.

This article is for general information only and is not financial advice.