Representative image. lmonk72, CC0, Wikimedia Commons
Why it matters
PHP runs a large share of websites, including many small business sites and blogs that rely on hosting companies. An unpatched server can be taken over, which can expose customer data or turn the site into a tool for attacks. Owners should confirm their PHP version or check with their host.
PHP2Shell, the name given to two critical flaws in PHP, a programming language widely used to build websites, has set off urgent patching by website owners after attack attempts jumped into the millions within a day of the bugs being made public. The PHP project released fixes on 21 October 2026, and the United States Cybersecurity and Infrastructure Security Agency (CISA) told organisations to patch immediately or take unpatched systems offline.
On 23 October PHP also flagged a third, separate issue in a short advisory, adding to the pressure on anyone who runs a website, an online shop or a business app built on PHP.
What the PHP2Shell bugs let attackers do
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 (CVE numbers are the standard IDs for publicly known security bugs), both allow remote code execution. In plain words, an attacker on the internet can make the server run commands of their choosing, without logging in and with a single web request sent before the site’s own code even starts.
The first PHP vulnerability is triggered when PHP runs out of memory while it is still setting up a request; the clean-up that follows can treat half-built data as valid. The second involves leftover data from one request that survives after its memory is freed and is then reused by the next request handled by the same worker, Help Net Security reported, citing the technical details.
Researchers at cloud security firm Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”. Security researcher Kevin Beaumont, as quoted by Help Net Security, said he expected “a mass of incidents”.
Every PHP set-up that answers web requests is affected, CISA said, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers Apache with mod_php the highest risk.
How fast attacks on the PHP vulnerability grew
The bugs were not a secret for long. Amazon’s threat intelligence team said its decoy servers, known as honeypots, logged an attempt to exploit them on 17 October, four days before public disclosure, while the details were still under embargo. It is not known how the attacker got the information.
After disclosure, Cloudflare said exploit attempts rose from tens of thousands in the first 45 minutes to millions by early on 22 October, The Hacker News reported. Security firms Sophos and Arctic Wolf reported attempts to install a variant of Mirai, malware that turns hacked machines into a botnet, a network of hijacked computers used for attacks. Other firms, including Wordfence, reported scanning and probing but no confirmed takeovers, and researchers said a reliable exploit was harder to build than first expected.
CISA said it had not seen successful exploitation as of its alert. Big vendors were checking their own products: Palo Alto Networks said all versions of its PAN-OS firewall software were affected, while Fortinet and Cisco were still reviewing their products and had not confirmed any as vulnerable.
A server taken over through PHP2Shell can expose the data stored on it. NewsPlainly has reported on what happens when such data escapes, as in the case of State Bank of India (SBI) customer records found on the dark web, though that leak was not linked to PHP.
Which PHP security update fixes PHP2Shell
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These updates do not install themselves, Sophos noted, so site owners or their hosting companies have to apply them.
Older releases are a bigger worry. PHP 8.1 and earlier no longer get regular support from the project. Minimal source fixes exist for versions 7.4, 8.0 and 8.1, but people on those versions are advised to check with their Linux distribution or support vendor, or upgrade.
The official advice, in the CISA alert and from the UK’s National Cyber Security Centre (NCSC), comes down to four steps:
- List every system that runs PHP, including PHP bundled inside other software.
- Apply the PHP security update now, starting with servers that face the internet.
- Take offline any system that cannot be patched straight away.
- Use a web application firewall (WAF, a filter that blocks malicious web traffic) as a stop-gap. Cloudflare said it had added initial WAF rules for known attack patterns, including for free-plan users.
The third PHP advisory, and what is still unclear
On 23 October PHP published an informational note about another bug, CVE-2026-115560. It only affects sites set up in an unusual way, involving how session data is stored, and PHP considers it unlikely to be a risk. There is no emergency patch; PHP advised turning off a setting called session upload progress until its next routine release, the same step it suggested for one of the PHP2Shell bugs.
PHP has not said which versions the third bug affects or how severe it is. For small businesses and bloggers whose websites run on PHP through a hosting company, the practical question is whether the host has already applied the PHP security update for PHP2Shell.
Frequently asked questions
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.
Is my website affected by the PHP vulnerability?
Any site that serves web requests through PHP on an unpatched version is affected, CISA said. Check your PHP version or ask your hosting company.
What if I cannot update PHP right away?
CISA and the UK's NCSC advise taking the system offline until it is patched; a web application firewall can help in the meantime.