PHP2Shell explained: the critical PHP flaws, who is affected and how to protect your website

On 21 October 2026 the PHP project shipped emergency security releases for two critical flaws, now known together as PHP2Shell. They let an attacker take control of a web server without a password and, in some setups, before the website's own code has even started running. Exploitation attempts were seen within hours of the fix.

PHP runs an estimated 75 to 80% of all websites, including WordPress, so this affects a very large share of the web. Here is what happened, who is at risk, and what to do now and in future.

What PHP2Shell is

PHP2Shell is two separate bugs in the core of PHP itself, not in a plugin or theme:

• CVE-2026-109618 is triggered when PHP runs out of memory part-way through setting up a request. Internal data is left half-built, and the clean-up code trusts it anyway. A specially crafted, oversized form submission can be enough to set it off.
• CVE-2026-109619 is a "stale state" bug. Information belonging to one request outlives the memory it points to, and the next request handled by the same PHP worker acts on the leftovers. Researchers showed it can be reached through PHP's upload-progress feature, which is switched on by default and runs on any form submission before the application sees it.

Both are rated 9.2 out of 10 (critical). Either one can give an attacker the ability to run their own code with the permissions of the web server. From there they can read databases and configuration files, plant backdoors, send spam, or use the server to attack others.

Where it came from

The flaws were found by security researchers at Calif, OpenAI and Wiz, and reported privately to the PHP security team. Disclosure was planned for 22 October. On 20 October, screenshots, videos and partial details of a tool called "PHP2Shell" leaked online, so PHP brought its emergency release forward to 21 October at 14:00 UTC.

The vulnerable behaviour is old. According to analysis by Abstract Security, affected code goes back to PHP 5.4, released in 2012, so it has been present for more than a decade. That is common with serious bugs in widely used software: code that works correctly in normal use can hide an edge case for years, until someone looks at it from an attacker's point of view.

What is happening now

• Active exploitation: security firm watchTowr saw exploitation attempts against its honeypot network on 21 October, the same day the fix was released.
• Scale: VirusTotal estimates more than 5.1 million PHP servers are exposed on the internet.
• Official warnings: the UK's National Cyber Security Centre urged UK organisations to update PHP immediately, or take systems offline until they are patched.
• Temporary shields: Cloudflare deployed web application firewall rules against the known attack methods and reported seeing early attacks. It described the rules as temporary, not a replacement for patching.
• Disputed completeness: one research team, Abstract Security, says it reproduced a related attack on a fully patched server by abusing the same upload-progress feature. This claim has not been confirmed by the PHP project, but it is one more reason to apply the hardening steps below as well as the update.

Who is affected

Any PHP installation that serves web pages is in scope, whichever way PHP is run: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed or FrankenPHP. The PHP team considers Apache with mod_php the highest risk, because an attack can succeed before any application code runs.

The fixed versions are:

In practice, that means:

• WordPress, Joomla, Drupal, Magento and most small business websites run on PHP. Your site is only as safe as the PHP version underneath it.
• Shared hosting customers depend on their host to update PHP. Many hosts patch automatically, but some still offer old PHP versions that no longer receive fixes.
• Old servers and forgotten sites are the biggest risk: a test site, an old campaign page or a staging copy running PHP 7 will not be fixed by any update.
• Appliances and control panels sometimes bundle their own copy of PHP, which your normal updates do not touch.

What to do right now

1. Find every place PHP runs. Websites, staging copies, control panels, internal tools and appliances. Start with anything reachable from the internet.
2. Update to a fixed version from the table above, or install your Linux distribution's patched packages, which in many cases were released ahead of the public announcement.
3. Restart every PHP worker after updating. Long-running processes keep the vulnerable code in memory until they restart.
4. If you are on shared hosting, check your PHP version in your hosting control panel. Move to a supported version (8.2 or newer) and ask your host to confirm in writing that the PHP2Shell fixes are applied.
5. If you cannot update today, restrict access to the server, disable session.upload_progress.enabled in your PHP settings and restart, and keep the maximum upload size as small as your site allows. The PHP team is clear that no setting fully protects you, so treat these as stop-gaps.
6. Check for signs of compromise from 20 October onwards, not just from the day you patched. Warning signs include PHP errors mentioning "tried to allocate" with "in Unknown on line 0", bursts of very large form submissions, unfamiliar PHP files in your website folders, new admin users, changed cron jobs or SSH keys, and the web server making unexpected outbound connections.

How to guard against the next one

PHP2Shell will not be the last critical flaw in software that runs the web. These habits reduce the damage next time:

• Stay on supported versions. Software that is past its end of life gets no fixes at all. Put upgrade dates in the calendar before support ends.
• Choose hosting that patches quickly, and ask how long critical PHP updates usually take to reach your account.
• Put a web application firewall in front of your site. Services such as Cloudflare and other CDNs can deploy virtual patches within hours, which buys time while you update.
• Remove what you do not use. Old sites, unused plugins and file-upload features you do not need are all extra doors.
• Limit the blast radius. Run each site under its own account, keep database users to the permissions they need, and store secrets outside the website folder.
• Monitor and keep backups. File-change monitoring, off-server logs and tested, offline backups turn a disaster into an inconvenience.
• Have a plan. Decide in advance who checks advisories, who applies emergency updates, and who you call if something has already gone wrong.

Need help?

If you are not sure which PHP version your sites run, or you want an independent check for signs of compromise, our team can help. We can review your exposure, verify the fixes are in place, and investigate any suspicious activity to a forensic standard. Contact us, or call our 24/7 line on +44 7520 644325.

Sources

• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• watchTowr: PHP2Shell FAQ
• Abstract Security: PHP2Shell analysis
• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched