On October 21, 2026, the team behind PHP released emergency patches for two critical security flaws. Together they’re nicknamed PHP2Shell, and they sit inside PHP itself, the software that powers an estimated 70% of websites on the internet. If your site runs on WordPress, Drupal, Joomla, or almost any custom build, this one applies to you.
Here’s what happened, in plain English, with nothing you need to look up.
What Is PHP2Shell?
PHP2Shell is the nickname for two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity, which puts them in the “critical” category.
PHP is the engine behind your website. Every time someone loads a page, PHP runs the code that builds it. These flaws are in that engine, not in WordPress, your theme, or any plugin, and that’s what makes this one unusual.
Researchers at Wiz, who helped find the flaws, demonstrated the attack against default WordPress, Drupal, and Joomla installs. A site doesn’t have to be badly built to be exposed.
Why This Flaw Is So Serious
Three things set PHP2Shell apart from a typical vulnerability:
- It needs no login. An attacker only has to send a web request to your server. Nobody has to click a link or guess a password.
- It reaches far back. The flaws affect PHP versions going back to 5.4, so nearly every PHP site was exposed until it was patched.
- Your own code can’t protect you. Because the problem lives in PHP, a well-maintained site is still vulnerable until PHP itself is updated.
The worst case is an attacker gaining control of the server. Even short of that, they may be able to read sensitive data out of the server’s memory, such as passwords, tokens, and API keys.
How the PHP2Shell Attack Works
You don’t need to understand memory management to follow the idea. When PHP handles a visitor’s request, it sets up a working area, does the job, and cleans up afterward. The flaws appear when something goes badly wrong in the middle, such as PHP running out of memory and stopping mid-task.
When that happens, PHP can leave half-finished data behind. The next request handled by the same process can then trust that leftover data. An attacker who crafts the first request carefully can use this to read secrets from memory or to make the server run their own code.
How Fast PHP2Shell Moved From Disclosure to Attacks
This one moved quickly:
- October 17: Amazon’s security team reported its honeypot recorded an exploitation attempt, four days before the public announcement.
- October 20: The CVE numbers and planned disclosure date leaked online. PHP posted an advance notice that evening and moved the release up a day.
- October 21: PHP released the patches. Cloudflare had switched on protective firewall rules for its customers hours earlier, and security firm watchTowr reported active exploitation attempts shortly after the release.
- Since then: Proof-of-concept exploit code is circulating, and Palo Alto Networks’ Unit 42 counted more than 22 million internet-exposed instances that could be vulnerable. Several organizations took sites offline as a precaution.
Researchers also say AI models helped turn these decades-old bugs into working exploits far faster than before. That shrinks the window between a flaw becoming public and attackers using it, which is why patching quickly matters more than it used to.
Which PHP Versions Are Fixed
PHP released fixes for every branch that still gets security updates. Whatever you run, you need to be on at least the version shown below.
PHP 8.1 and older no longer get official updates, although some Linux distributions and long-term-support vendors have backported the fix. PHP 8.2 stops receiving security fixes on December 31, 2026, so if you’re on it, plan a move to 8.4 or 8.5.
What Business Owners Should Do Right Now
- Ask your host or developer. Ask whether PHP has been updated for CVE-2026-109618 and CVE-2026-109619. If a provider manages PHP for you, they’re the ones who need to apply the update.
- Check your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, then Server. Some hosts patch under the old version number, so ask for confirmation rather than relying on the number alone.
- Skip the quick-fix plugins. Updating PHP is the only complete fix. Be wary of plugins or code snippets that claim to patch this for you.
- Keep your firewall on. A web application firewall such as Cloudflare’s adds a layer of protection while you patch, but it doesn’t replace the update. The UK’s National Cyber Security Centre even advises taking a system offline if it can’t be patched or mitigated right away.
How We Handled PHP2Shell at Digital Aspect
We treated this as an emergency from the moment it was spotted, and we upgraded to the patched PHP versions within a few hours. Here’s what that looked like:
- We inventoried the PHP versions running across the servers and sites we manage.
- We upgraded to the patched PHP releases within hours of the vulnerability being spotted.
- We restarted the web services so the patched version was actually loaded, since an update that hasn’t been restarted isn’t protecting anything.
- We confirmed the new versions were live.
If your website is hosted or managed by us, this is already taken care of. Our website hosting exists for moments like this, so that a critical flaw in the software under your site becomes our emergency rather than yours.
Not sure whether your website’s PHP has been patched? See how our team keeps your website secure and up to date →
