PHP2Shell: The Critical PHP Vulnerability Putting 70% of Websites at Risk

PHP has two critical security bugs, nicknamed PHP2Shell, that let attackers run their own code on a web server without logging in. The fixes shipped on 21 October 2026, and every site running PHP should update now.

If you run a WordPress, Drupal, Joomla, Laravel or custom PHP website, this one is about you. PHP powers 69.3% of all websites whose server-side language is known, according to W3Techs. The PHP security team calls both flaws critical and says updating is the only complete fix.

Pakistan is paying attention too. In the 24 hours to 23 October, Google Trends data for Pakistan shows searches for "php vulnerabilities" up 120%, while "php security vulnerabilities" was marked as a Breakout search. Below, we break down what happened, who is at risk, and exactly what to do today.

PHP2Shell at a glance

PHP2Shell by the numbers

What is the PHP2Shell vulnerability?

PHP2Shell is a pair of memory-safety bugs inside the PHP engine itself, tracked as CVE-2026-109618 and CVE-2026-109619. A crafted HTTP request can let an attacker take over the server, read secrets from memory, or crash the site, with no login needed.

The key word is engine. Most PHP security issues live in a plugin, a theme or a piece of custom code. PHP2Shell lives one layer below all of that. Wiz Research showed that even a plain "Hello World" page on an unpatched PHP version can be attacked.

Wiz demonstrated two kinds of damage:

• Remote code execution (RCE): full takeover of servers running the latest WordPress, Drupal and Joomla container images.

• Memory disclosure: reading leftover data from the PHP worker, which can include passwords, session tokens, API keys and certificates.

The U.S. National Security Agency put it plainly: these are flaws in PHP, not in the hosted application or its configuration. A clean, well-coded website is still exposed if the PHP version underneath is old.

Which PHP versions are affected, and which are patched?

Every PHP installation that serves web requests is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026.

The PHP advisory rates Apache with mod_php as the highest-risk setup, because a demonstrated exploit fires before any application code runs.

The old-version problem is large. W3Techs data from 22 October 2026 shows 65.3% of PHP websites on version 8, 26.9% on version 7 and 7.7% still on version 5. That means roughly 1 in 3 PHP sites runs a branch with no official PHP2Shell release.

One more warning from PHP.net: users of the volunteer-run rpms.remirepo.net repository should switch to distribution packages or build from source, because that repo had no same-day update.

How does the PHP bug actually work?

The bug lives in how PHP cleans up after a request crashes, usually from running out of memory. PHP leaves half-built or already-freed data behind, and the next request on the same worker trusts that stale data. Attackers fill that freed memory with their own bytes.

Cloudflare explains it in plain terms. PHP sets aside memory for each request and releases it when the request ends. When a request stops suddenly, the cleanup goes wrong.

Sources: PHP.net advisory, Wiz technical write-up.

Why did nobody catch this before? The vulnerable code had sat in PHP for more than 10 years. According to Fortune, OpenAI president Greg Brockman said the bug had been present for 14 years, and a limited version spotted in 2024 was judged minor at the time. Turning it into a working attack meant chaining several flaws and adapting to each server's memory layout, which Wiz describes as being at the edge of what human researchers could do by hand.

How did AI discover the PHP vulnerability?

Three security teams found the flaws separately in August 2026, and all three used AI models. Calif found the first issue on 1 August with OpenAI's GPT-5.6 Sol. Wiz found it on 19 August using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool.

Calif was working inside OpenAI's Patch the Planet programme, which hunts for bugs in open-source infrastructure. OpenAI then dug deeper and found more pieces of the same flaw. When OpenAI spoke to the PHP Foundation, it learned Wiz had independently reported the same issues, so OpenAI pulled everyone into one coalition with PHP, Cloudflare and several U.S. government agencies.

Wiz says a single researcher using frontier AI finished in one week what would once have taken a world-class team months. That is the uncomfortable part of this story. The same tools that help defenders find old bugs also help attackers turn a patch into a working exploit within hours, as AWS warned.

PHP2Shell timeline (newest first)

Is PHP2Shell being exploited right now?

Yes, attack attempts are happening at large scale, but successful break-ins are harder to confirm. Cloudflare counted millions of attempts by the evening of 21 October, while some researchers say public exploits fail against a default PHP setup.

The attack curve rose fast. Cloudflare CEO Matthew Prince reported tens of thousands of exploit attempts within 45 minutes of the news spreading, hundreds of thousands within 2 hours, and millions by the evening of 21 October, as Fortune reported. AWS now describes the flaw as broadly exploited in the wild, and watchTowr saw exploitation in its honeypot network from 21 October.

The picture is not one-sided, though:

• Sansec said on 22 October that an attack needs specific knowledge of the target server, and public exploits do not work on a default PHP install.

• Huntress had seen no exploitation on partner systems as of 20:30 UTC on 21 October, per Brandefense.

• As of 22 October, CISA had not added either CVE to its Known Exploited Vulnerabilities catalogue.

• The Dutch NCSC said on 22 October it is investigating first signs of successful misuse.

Real damage is already being claimed. One startup founder said attackers stole source code, exposed cookie data and leaked legal documents, according to Fortune. The fair takeaway: not every unpatched site will be hit today, but the risk climbs every hour exploits keep improving. Patch first, debate later.

How are governments and tech companies responding?

Governments took sites offline and issued urgent patch orders, while security firms pushed out firewall rules and scanners within hours. The NSA called the risk serious enough to require immediate patching across U.S. government agencies.

The lesson for business owners is simple. When the NSA, a prime minister and the world's biggest cloud providers all say "update now" on the same day, a small website should not wait for its next maintenance window.

Why does one PHP flaw put 70% of the web at risk?

PHP grew from a personal tool in 1994 into the default language of the web, and WordPress carried it to the mainstream. Today PHP runs 69.3% of websites with a known server-side language, so a bug in its core touches millions of sites at once.

What is PHP, and what does PHP stand for?

PHP stands for PHP: Hypertext Preprocessor, a recursive name. According to the official PHP history, Rasmus Lerdorf created it in 1994 as "Personal Home Page Tools", a set of C programs that tracked visits to his online CV. He released the source code in June 1995. In 1997, Andi Gutmans and Zeev Suraski rewrote the parser, and PHP 3.0 launched in June 1998 under its current name.

The growth since then is the whole story:

• 1998: about 60,000 domains, roughly 1% of the internet, had PHP installed (PHP.net).

• 2013: PHP ran on more than 240 million websites (Wikipedia).

• 2026: PHP powers 69.3% of sites with a known server-side language, including subdomains of Microsoft.com, Wikipedia.org and Archive.org (W3Techs).

A developer-friendly overview of each release is in Muhammad Usman's history of PHP on DEV.

How is WordPress connected to PHP?

WordPress is written in PHP, so every WordPress site inherits PHP's security. Matt Mullenweg and Mike Little forked the b2/cafelog blogging tool in January 2003, and WordPress 0.7 launched on 27 May 2003 (WordPress.org, Namecheap). Today WordPress alone powers roughly 40% of all websites, according to Reuters as cited by Fortune.

That matters for business owners in Pakistan. Many local business, e-commerce and agency websites run WordPress or WooCommerce on shared hosting. On shared hosting, you often do not control the PHP version: your hosting company does. Updating WordPress core or plugins will not fix PHP2Shell; only a PHP update will.

How do I check my PHP version and patch PHP2Shell?

Check your PHP version first, then move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and restart every PHP worker. Most site owners can do the check in under 5 minutes from WordPress, cPanel or the command line.

1. Check your PHP version. Use whichever is easiest:

   • WordPress: go to Tools → Site Health → Info → Server and read the PHP version.

   • cPanel or hosting panel: open "Select PHP Version" or "MultiPHP Manager".

   • Server terminal: run php -v. Also check the version your web server uses, which can differ from the CLI.

2. Compare it with the safe list. Anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on those branches is vulnerable. Anything on 8.1 or older needs an upgrade plan.

3. Update PHP. On a VPS, install your Linux distribution's updated packages; distributions received the patches in advance (PHP.net). On shared hosting, ask your provider in writing which PHP build they run and when it was patched.

4. Restart every PHP worker. Restart PHP-FPM, Apache or LiteSpeed so no old process keeps running vulnerable code.

5. Verify the fix. OpenAI published a free PHP2Shell version checker, and Searchlight Cyber released an open-source scanner, per Help Net Security.

6. Look back for signs of attack. AWS advises starting any investigation from 17 October, not the disclosure date (AWS).

Warning signs worth checking in your logs, according to Wiz and AWS:

• Unusual multipart (file upload) requests followed by memory-limit errors or repeated HTTP 500 errors.

• POST requests containing the string PHP_SESSION_UPLOAD_PROGRESS.

• Oversized or malformed PHPSESSID cookies in responses.

• PHP workers crashing and restarting without a clear reason.

• Unexpected new files or processes on the web server.

If you find any of these, rotate passwords, API keys and database credentials after patching, because PHP2Shell can leak them from memory.

What can I do if I cannot update PHP today?

Turn on a web application firewall and apply PHP's temporary settings, but treat them as a bandage, not a cure. PHP.net states these steps reduce specific attack paths and do not make an installation safe.

Quick protection layers:

• Put the site behind a WAF. Cloudflare protects all plans with WAF enabled, including Free, by default (Cloudflare). AWS has published AWS WAF rules.

• Block multipart file uploads on sites that do not need them, after testing the effect on your forms (AWS).

• Take truly unpatchable systems offline. This is the NSA's advice for anything that cannot be fixed quickly (NSA).

Temporary PHP settings from the official advisory:

Two cautions from PHP.net. Do not apply these through ini_set() or .user.ini, because they must load before request parsing. And do not use RLIMIT_AS or RLIMIT_DATA as a memory cap, since those can trigger the very failure attackers need.

PHP2Shell FAQ

What happened to PHP?

On 21 October 2026, PHP released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. They let attackers run code on unpatched web servers without logging in. PHP itself is still safe to use once you are on a patched version.

What is the latest PHP version?

The newest stable release is PHP 8.5.12, published on 21 October 2026. The other patched branches are 8.4.27, 8.3.36 and 8.2.35. PHP 8.6 is still in release-candidate testing and is not for production use (PHP.net).

Does updating WordPress or my plugins fix PHP2Shell?

No. The bugs are in the PHP runtime, not in WordPress, themes or plugins. Cloudflare confirms that changing website code alone does not fix them. You or your host must update PHP.

Is PHP 7.4 affected by PHP2Shell?

Yes. Wiz found at least one of the flaws in every PHP release back to 5.4. PHP 7.4 gets no official release, only a source-code backport on GitHub. Upgrading to PHP 8.3 or 8.4 is the safer long-term move.

Do I need to take my website offline?

Only if you cannot patch or protect it. The NSA advises taking unpatchable systems offline. Sansec says public exploits do not work against default installs, so a patched site behind a WAF can stay online.

Was AI used to hack PHP?

AI was used to find the bugs, by defenders. Calif, OpenAI and Wiz used GPT-5.6 Sol, Gemini 4 Argon and Wiz Atlas. AWS warns that attackers now use similar tools to build exploits within hours of a patch.

What is the CVSS score of CVE-2026-109618?

Both PHP2Shell CVEs are rated 9.2 on the CVSS v4.0 scale, which falls in the critical band (Unit 42).

The bottom line

PHP2Shell is a 14-year-old bug that AI finally made exploitable, and attackers moved within hours. The fix is free and already out. Check your PHP version today, update to a patched release, and keep a firewall in front of your site. If you are not sure who manages PHP on your hosting, our website maintenance team can help you check.

Running an older site you have not looked at in a while? A technical SEO audit also flags outdated server software like an unsupported PHP version before it turns into a security or ranking problem. New to the term? Start with what SEO is.