TL;DR: PHP2Shell is a pair of critical security flaws in PHP, the programming language behind most websites and many company systems. One web request, with no login, can let an attacker take over the server. Attacks have already started. What to do:
- Find every website and system your company runs on PHP, including ones a supplier looks after.
- Update each one to a fixed version of PHP (8.5.12, 8.4.27, 8.3.36 or 8.2.35), or get a fix from your hosting company or Linux vendor if you're on an older version.
- Anything you can't fix this week: take it off the public internet until you can.
On 21 October 2026, the PHP project released emergency fixes for two flaws it rated 9.2 out of 10 for severity. The flaws are in PHP itself, not in your website or its plugins. That means almost every PHP system is affected, however well it was built. Details leaked online a day before the fixes came out, and security companies saw attack attempts even earlier.
This post explains what PHP2Shell is, which systems it affects, what an attacker can do, how to check your own systems, and how to fix them. Some steps need a technical person. Where they do, we've written them so you can forward that part to your IT person, developer or hosting company.
What is PHP2Shell?
PHP is the language many websites and web systems are written in. WordPress, Drupal, Joomla, Magento and Laravel all run on it, and so do many custom-built customer portals, booking systems and internal tools. By one estimate, around 70% of websites use it.
PHP2Shell is the name given to two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 (CVE numbers are the standard IDs for security flaws). Both come from the same kind of mistake: PHP doesn't always clean up its memory properly when a web request ends abruptly. An attacker can send a specially shaped request that leaves memory in a broken state, and then use that broken state to make the server run commands of their choosing.
Three things make it serious:
- No login is needed. The attack works on public pages. A login screen doesn't protect you, because PHP processes the attack before your website's own code runs.
- It's in PHP, not your app. Updating WordPress, plugins or your own code doesn't fix it. Even a one-page website on an unpatched server is at risk.
- Attackers are already trying it. Amazon's security team recorded an attack attempt on 17 October, four days before the fixes. Cloudflare and other security companies reported attacks and wide scanning from 21 October.
The flaws were found by security researchers using AI. Researchers at Calif, working with an OpenAI model, and OpenAI itself reported the main flaw to PHP on 11 August 2026. Researchers at Wiz found more ways to exploit it, also using AI, and reported them on 24 August. Signs of the underlying memory problem were spotted in a 2024 security audit, but nobody showed then that it could be exploited, and the fix stalled. Wiz says the vulnerable code had been in PHP for more than a decade, and that AI made the difficult work of turning it into a working attack much faster. Attackers have the same tools, which is one reason they moved so quickly.
Which systems are affected?
Any system running PHP to serve web pages is affected unless it has been patched. That includes:
- Your company website, if it runs on WordPress, Drupal, Joomla or another PHP system.
- Online shops built on WooCommerce, Magento or OpenCart.
- Custom systems written in PHP: customer portals, booking systems, quotation tools, HR or inventory systems, often built years ago by an agency or freelancer.
- Software and devices from suppliers that use PHP inside. Many routers, firewalls, storage boxes and business software packages have a web control panel written in PHP. Palo Alto Networks, for example, has said all versions of its PAN-OS firewall software are affected. Fortinet and Cisco are still checking their products.
Some details your technical person will want:
- Versions: every PHP version before this week's fixes is affected, back to PHP 5.4 (released in 2012).
- Setups: all common ways of running PHP on a web server are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates Apache with mod_php as the highest risk, because a working attack has been shown that succeeds before any website code runs.
If your website is on a fully hosted platform such as Shopify, Wix or Squarespace, you don't manage the server, so updating it is the provider's job. If you use a managed WordPress or "website builder" service, check its status page or ask support to confirm it has patched.
What can an attacker do?
Once in, an attacker can run any command the website itself is allowed to run. In practice, that is usually enough to:
- Steal data. Websites store the passwords they use to reach their database in a settings file. With those, an attacker can copy customer records, orders, enquiries and staff accounts.
- Read passwords and keys straight from memory. One of the two flaws lets an attacker read pieces of the server's memory without running any code at all. That memory can contain passwords, login sessions and API keys (the passwords one system uses to talk to another, such as a payment provider or email service) belonging to other visitors.
- Change your website. Deface it, or quietly add code that infects visitors or steals card details typed into checkout pages.
- Leave a back door. Attackers often plant a hidden file (a "web shell") that lets them come back later. It stays after you patch PHP, so patching alone doesn't remove an attacker who is already in.
- Use your server for their own ends. Mining cryptocurrency, sending spam, or attacking other companies, with your company's name on the traffic.
- Reach other systems. If the server can see your file server, accounting system or other databases, the attacker can try those next.
There is one limit. The attacker gets the website's permissions, not full control of the server (called "root" or administrator access). But the website has access to the data that matters most, so this limit doesn't protect much.
For the business, the results look familiar: the website goes down or gets flagged by Google as dangerous, email from your domain lands in spam, customers lose trust, and you may have a data breach to report. In Singapore, a breach that has to be reported must reach the PDPC (Personal Data Protection Commission) within 3 calendar days of deciding it is reportable.
How to check if you're affected
Step 1: List every system that runs PHP
Most companies have more PHP systems than they think. Make a list with one row per system, starting with anything the public can reach from the internet:
- The main website, plus old ones: campaign sites, a previous version still online, a staging copy.
- Online shops, customer portals and booking forms.
- Internal systems built by an agency or freelancer.
- Network equipment and supplier software with a web control panel.
For each one, write down who looks after it: your staff, an agency, a hosting company or a supplier. If you don't know whether something uses PHP, ask whoever built or supplies it. A useful question is: "Does this use PHP, and has it been patched for PHP2Shell?"
Step 2: Find out the PHP version, and whether it's patched
For each system, you need the PHP version and whether the fix is in. Here is where each version stands:
| Your PHP version | Fixed version | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update |
| 8.4 | 8.4.27 | Update |
| 8.3 | 8.3.36 | Update |
| 8.2 | 8.2.35 | Update, and plan an upgrade: 8.2 support ends 31 December 2026 |
| 7.4, 8.0, 8.1 | No official release | Get a fix from your host or Linux vendor, or upgrade |
| 7.3 and older | No fix from PHP | Check your vendor; otherwise take it offline and upgrade |
Two things trip people up:
- Updating your website doesn't update PHP. WordPress, plugins and frameworks like Laravel sit on top of PHP. They are two separate layers, and both need to be up to date.
- The version number can mislead. Linux vendors such as Ubuntu and Red Hat often fix older versions without changing the number. Ubuntu 24.04's fixed package still says PHP 8.3.6, for example. So "8.3.6" can be patched, and checking the number alone isn't enough. The check below looks at the package itself.
If you have your own server, forward this to your IT person or developer:
# Debian / Ubuntu: list installed PHP packages and versions,
# then compare against your vendor's security tracker
dpkg -l 'php*' | awk '/^ii/ {print $2, $3}'
# Red Hat / AlmaLinux / Rocky: confirm the fix is in the package
rpm -q --changelog php | grep -E 'CVE-2026-10961[89]'Then compare the result with the vendor's security page for these two CVE numbers (Ubuntu, Debian and Red Hat each publish one). Also check the PHP that actually serves the website, not just the one on the command line. Docker containers and some control panels carry their own separate copy of PHP.
If you're on shared hosting or a hosting company manages the server, send them this:
"Has the server my website runs on been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? Which PHP version is my site on? If it's 8.1 or older, does it include your backported fix? Have PHP processes been restarted since the update?"
Step 3: Check for signs of a break-in
If a system was online and unpatched at any point since 17 October, assume someone may have tried. Patching closes the door, but it doesn't tell you whether someone already walked through it. Ask your technical person to look for:
- New or changed
.phpfiles in the website folders that nobody on your side added. - The web server starting programs it normally wouldn't, such as a command shell or download tools.
- New scheduled tasks or user accounts on the server.
- In PHP's error log: "Allowed memory size exhausted" errors ending in "Unknown on line 0", especially next to very large form submissions. These can happen for innocent reasons, so treat them as leads, not proof.
Your website's own logs may show very little, because the attack happens in PHP before the website code runs.
How to fix it
The fix depends on your PHP version. Only an update fixes the flaws. The settings and firewall rules further down reduce the risk while you work on it, but PHP itself says they "do not make an installation safe".
If you're on PHP 8.2 or newer: update and restart
Install the fixed version for your branch from the table above, through your normal Linux updates, control panel (cPanel, Plesk, DirectAdmin) or hosting company. Then restart PHP. A running PHP process keeps the old code in memory until it restarts, so updating the files alone isn't enough. For most sites this takes minutes.
If you're on PHP 7.4, 8.0 or 8.1: get a backported fix
The PHP project stopped supporting these versions and hasn't released new versions of them. You have two ways to get a fix while you plan an upgrade.
Option 1: Get the fix from your Linux vendor or hosting company. Many have applied the fix to older versions for you (called a "backport"). By 22 October this included Ubuntu Pro, Debian's extended support, Red Hat, cPanel, Plesk, DirectAdmin and CloudLinux. Often the version number stays the same, so use the check in Step 2. A few common sources were not updated at the time of writing: the popular Remi repository for Red Hat-style servers, and official Docker images, which aren't published for 8.1 and older. If your PHP comes from one of these, or was compiled by hand, Option 1 won't help.
Option 2: Apply PHP's own source patch. Because the flaws are so serious, the PHP team published patches for 7.4, 8.0 and 8.1 as source code only. Someone technical has to download the code, apply the patch, compile PHP, swap it in and test the website. Once you do this, nobody else is updating that copy of PHP. If another flaw appears, you have to do it all again. Some companies sell extended support for old PHP versions, which takes this work off your hands for a fee.
If you're on PHP 7.3 or older
PHP has published no fix for these versions. Some vendors have patched them anyway: Ubuntu Pro, Debian's extended support, DirectAdmin and the Sury packages for Debian and Ubuntu all report fixes for some older versions. Ask yours. If there's no fix, take the system off the public internet (see below) and treat the upgrade as urgent. The UK's National Cyber Security Centre and the US National Security Agency have both advised taking systems offline if they can't be updated.
While you work on it: reduce the risk
These steps apply whatever version you're on. They don't fix the flaws, but they block the known ways in and buy time.
1. Change four PHP settings. Forward this to your technical person. The settings must go in the main PHP configuration (php.ini, the PHP-FPM pool or the web server configuration), not inside the website's code, and every PHP process must be restarted afterwards.
memory_limit = -1: removes PHP's own memory cap, because hitting that cap is what sets off the first flaw. Put a memory limit on the server or container instead, so one runaway request can't take the whole server down.post_max_size = 8M(or32Mif the site accepts file uploads): limits how much data one form submission can send, which makes the attack harder.session.upload_progress.enabled = 0: switches off a little-used upload progress feature that the second flaw goes through. Keep this off even after patching: on 23 October PHP asked everyone to leave it off until the next regular release, because of a further, less likely problem it has found.fatal_error_backtraces = 0: on PHP 8.5 only, switches off extra detail in error reports, which closes another known path.
2. Put a web firewall in front of the site. A web application firewall (WAF) filters out harmful requests before they reach your server. Cloudflare has added rules for the known PHP2Shell attacks for all customers, including the free plan. Attackers are already changing their requests to get past these rules, so treat them as a short-term shield.
3. Take internal systems off the public internet. This is the strongest step. A staff portal, admin panel or internal system usually doesn't need to be open to the whole world. Put it behind a VPN (a private, encrypted connection staff log in to first) or allow only your office's internet address. An attacker who can't reach the system can't attack it.
The long-term fix: upgrade to PHP 8.4 or newer
A backport fixes this one problem. It doesn't fix the next one. Old PHP versions no longer get regular security fixes, so every new flaw means another scramble. Upgrading puts you back on versions that get fixes as a matter of course.
Be careful with "we're on PHP 8". PHP 8.0 and 8.1 are already unsupported, and 8.2 support ends on 31 December 2026. Aim for 8.4 or 8.5, which are supported until the end of 2028 and 2029.
For some systems, the upgrade is quick. For others, it's a project. Moving from PHP 7 to 8 is harder when:
- The code uses features PHP 8 removed. Code that ran for years can stop working, sometimes only on one rarely used page.
- The framework is old. An old version of Laravel, CodeIgniter or Yii may need upgrading first, one step at a time.
- Plugins or add-ons are abandoned. If nobody maintains a plugin anymore, it may need replacing.
- There are no automated tests. Without tests that check the system still works, every page has to be checked by hand.
In our experience, a small, up-to-date WordPress site can take an afternoon. A large custom system written for PHP 5 or 7 can take several weeks. Either way, get it assessed now, so you know which one you have before the next flaw arrives.
If a system was exposed before you patched it
If a system was online and unpatched at any point since 17 October, patch it first, then:
- Change the passwords and keys it held. Database passwords, API keys for payment and email services, admin accounts and security certificates. Because of the memory flaw, these could have been read without any trace on disk. Don't wait for proof of a break-in.
- Check for back doors. Run through Step 3 above. If you find anything, restore the website from a backup made before 17 October where you can, then apply the fix before putting it back online.
- Decide whether personal data was involved. If customer or staff data may have been taken, follow your data breach process, and speak to a lawyer if you're unsure whether it needs reporting.
Your action plan
Today
- Ask your IT person, developer or hosting company whether your website and systems use PHP, and whether they are patched.
- Take anything internal off the public internet if it doesn't need to be there.
- If you can't patch today, apply the four settings and a web firewall.
This week
- Finish the list of every PHP system, including supplier software and devices.
- Patch or get a backported fix for each one, and restart PHP.
- For anything exposed since 17 October: change passwords and keys, and check for back doors.
Next
- Get an estimate for upgrading every system older than PHP 8.4.
- Schedule the upgrades. Use a backport only as a bridge until they're done.
What we don't know
- Whether more flaws will follow. On 23 October PHP announced a third, related problem (CVE-2026-115560), which only affects unusual setups and will be fixed in the next regular release. Researchers at Datadog expect more problems of this kind, because the underlying pattern in PHP's code is still there.
- How many systems have been broken into. As of 22 October, attack attempts were widespread but few confirmed break-ins had been made public. That usually changes over the following weeks.
- Supplier fixes are still arriving. Linux vendors, control panels and device makers have been releasing fixes at different times since 21 October. If a supplier said "not yet" earlier this week, ask again.
Sources
- PHP security advisory, 21 October 2026, and the 23 October follow-up on the same page
- Wiz Research: PHP2Shell
- Datadog Security Labs: detection, analysis and remediation
- Help Net Security
- BleepingComputer
- SentinelOne: timeline and response
- Digital Applied: fixes by Linux distribution and control panel
- watchTowr: PHP2Shell FAQ