PHP2Shell: Critical flaws in PHP put millions of websites at risk

Website owners around the world are being urged to update their servers after the PHP project released emergency fixes for two critical security flaws that can let attackers take control of a web server without needing a password.

The flaws, which security researchers have nicknamed PHP2Shell, were disclosed on Wednesday 21 October, a day earlier than planned after details began leaking online. The BBC reported on the issue as hosting companies and security teams rushed to patch.

PHP is one of the most widely used programming languages on the internet. It powers WordPress, Drupal and Joomla along with countless shops, forums and company websites, which is why security experts have described the bugs as among the most serious of recent years.

What is PHP?

PHP is a programming language that runs on web servers and builds pages before they are sent to your browser. When you log in to a website, add something to a basket or post a comment, there is a good chance PHP is doing the work behind the scenes.

It was created in the mid-1990s and is now looked after by volunteers and the non-profit PHP Foundation. Because it is free and comes ready to use with almost every web hosting package, it became the default choice for building websites, and it is the language that WordPress, the world’s most popular website software, is written in.

What has happened?

The PHP security team has fixed two vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, and rated both 9.2 out of 10 for severity.

Both bugs sit deep inside PHP itself rather than in any particular website or plugin. The first is triggered when PHP runs out of memory while it is still setting up a request, which can leave data in a half-finished state that PHP then treats as valid. The second happens when information from one visitor’s request is left behind after its memory has been freed, so that a later request handled by the same server process can end up using it.

In both cases a skilled attacker can corrupt the server’s memory and run their own code, with no login required. In its official security advisory, the PHP team said it considered the risk highest for servers running PHP through Apache’s mod_php module, where a working exploit had been demonstrated that “can trigger the attack before any application code runs”.

Who is affected?

According to PHP, every installation that serves web pages is at risk. That covers the most common ways of running PHP, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The UK’s National Cyber Security Centre went further in its alert, saying that organisations using any version of PHP are affected. That includes software and devices that quietly bundle PHP inside them, from control panels to network appliances, so the problem is not limited to people who know they run a PHP website.

Ordinary visitors to websites do not need to do anything, but anyone who owns or manages a site built on PHP should check that it has been updated.

Are hackers already exploiting it?

Yes. Amazon’s security team said in a blog post that one of its decoy servers had been targeted on 17 October, four days before the flaws were made public, which suggests someone had the details while they were still secret. After disclosure it recorded further attempts from several different sources and said that PHP2Shell was “now being broadly exploited in the wild”.

Amazon also warned that the time between a fix being published and attackers turning it into a working exploit is shrinking, partly because AI tools make that analysis faster, and said patching for critical flaws like this should be measured in hours rather than days.

How were the flaws found, and why was the release rushed?

The PHP Foundation, which funds work on the language, said in a detailed statement that early signs of the memory problem had first surfaced during a security audit in 2024, but no clear route to an attack was found at the time and work on a fix stalled. It admitted that the delay was “a structural failure, caused by both the security team’s decision process and its lack of resources”.

This summer several research groups, including the security firms Calif and Wiz and the AI company OpenAI, independently reported the same underlying problem and showed it could be used to take over real websites. Some of that research was carried out with the help of AI models, and the Foundation said AI-assisted research had led to a sharp rise in the number of bug reports it receives.

The release had been planned for 22 October, but the vulnerability numbers began circulating online on the afternoon of 20 October. PHP brought the update forward to 14:00 UTC on 21 October, and the Foundation said a research video that was briefly posted online that evening helped others work out how the attack worked.

What should website owners do?

The only complete fix is to update PHP. The patched versions are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If your site runs on shared or managed hosting, log in to your control panel to see which PHP version it uses, and contact your host if you are not sure whether it has been patched. Many large hosts were given the fixes in advance and have already updated their servers.

If you manage your own server, install the updated packages from your Linux distribution or download the new release from php.net, then restart your web server and PHP processes. PHP said Linux distributions and long-term support vendors had received the patches early, so updates should already be available through the usual channels.

PHP 8.1 and older versions no longer receive official updates. Because the flaws are so serious, the PHP team has published basic fixes for versions 7.4, 8.0 and 8.1 for people who build PHP themselves, but anyone on an old version should plan to move to a supported release as soon as possible.

For servers that cannot be updated straight away, PHP has listed temporary settings that block the known attack routes, including turning off the session upload progress feature in the main PHP configuration. The PHP team stresses that these measures reduce the risk but do not make a server safe, and the NCSC advises that systems which cannot be patched or protected quickly should be taken offline.

Anyone who suspects a server may already have been compromised should look for unfamiliar files in the website folder, new user accounts and unexpected scheduled tasks, and should consider getting professional help.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname given to two critical security flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to run code on a web server without logging in.

Is my WordPress site affected?

Very likely, if it runs on an unpatched version of PHP. The flaws are in PHP itself rather than in WordPress, so updating WordPress or its plugins will not fix them. Check that your host has upgraded PHP to one of the fixed versions.

Which PHP versions fix the problem?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026. Older versions from 8.1 downwards are no longer officially supported.

Do I need to do anything if I just visit websites?

No. The flaws affect the servers that run websites, not the people visiting them, so there is nothing for ordinary internet users to install.

Is PHP2Shell being used by hackers?

Yes. Amazon has reported attacks both before and after the flaws were made public, and says they are now being widely exploited, which is why site owners are being told to update immediately.