PHP2Shell: The PHP Flaw That Puts Most Business Websites at Risk

On 20 October 2026, details of two critical flaws in PHP leaked on social media two days before their planned disclosure. The PHP team pulled its emergency release forward to the next afternoon. By then, Cloudflare was already seeing attacks.

That matters to far more businesses than the usual security headline. PHP is the language behind an estimated 75 to 80 percent of websites, including every WordPress, WooCommerce, Joomla and Drupal site. If you own a business website and you have never asked what it runs on, the answer is probably PHP.

The flaws are called PHP2Shell, and five days after the fix shipped, 93.6% of the PHP servers that could be measured were still unpatched.

What PHP2Shell actually is

There are two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers at Calif, OpenAI and Wiz. They share one root cause: when a web request ends abnormally, PHP can leave its memory in a broken state. In the first flaw, PHP runs out of memory partway through setting up a request and leaves internal data half built. In the second, internal state outlives the request it belongs to, so the next visitor's request handled by the same worker can act on leftover data.

You do not need to follow the memory details. What you need is the outcome. An attacker who can send requests to your website, which is anyone on the internet, can use either flaw to run their own code on your server with the web server's permissions. No password. No account. No phishing email that someone has to click.

The PHP Group rates both 9.2 out of 10 (Critical). CISA added both to its Known Exploited Vulnerabilities catalog on 26 October, which is its list of flaws attackers are confirmed to be using. The UK's National Cyber Security Centre told organisations to update immediately or take affected systems offline until they could.

The PHP security team says the risk is highest for Apache with mod_php, a common setup on older and shared hosting, where a demonstrated attack succeeds before any of your website's own code has run. That detail matters, because it means a well-written site with every plugin updated is exposed in exactly the same way as a neglected one. The flaw sits underneath your application, not in it.

Why this one is worse than the usual "update your plugins"

Most website security advice is about plugins and themes, and it is good advice. PHP2Shell is different in three ways.

It hits the layer nobody looks at. Business owners update WordPress because the dashboard nags them. Almost nobody checks the PHP version, because it lives with the hosting provider, set once when the site was built and never touched again.

Attackers had a head start. Because the details leaked early, exploitation began before patches existed. watchTowr observed attacks in its honeypot network from the day the fix shipped.

A huge share of sites cannot simply be patched. OX Security has tracked every publicly visible PHP server since the release. Here is what it found on 26 October:

Those figures only count servers that advertise their PHP version, so the true number of exposed sites is higher, not lower. And that 1.33 million is the uncomfortable part. A site on PHP 7 or PHP 8.0 does not get an update you can click. It needs an upgrade, and an upgrade can break an old theme or plugin, which is usually exactly why the site was left on an old version in the first place.

What to check today, in order

You can do the first two steps yourself in about ten minutes.

1. Find out your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. On most hosts, the control panel (cPanel, Plesk, or your host's own dashboard) shows it under a "PHP version" or "MultiPHP" setting. If someone else manages your site, send them one line: "Which PHP version is our site on, and is it patched for CVE-2026-109618 and CVE-2026-109619?"
2. Compare it against the fixed versions. You are safe from PHP2Shell on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or anything newer in the same line. Everything else needs action.
3. Update, then restart PHP. On a managed or shared host, your provider updates PHP itself, but many hosts let customers pin an older version, and a pinned version may stay unpatched. Switch to a patched supported version in the control panel. If you run your own server, install the fixed release and restart every PHP worker, or the old code keeps running.
4. If you are on PHP 8.1 or older, plan the upgrade now, not next quarter. Test the site on a staging copy with PHP 8.3 or 8.4, fix what breaks, and switch. If that cannot happen this week, restrict who can reach the server, put it behind a web application firewall, or take it offline. A site that is down for a few days costs less than one that is quietly serving malware to your customers.
5. Check whether you were already hit. Look for administrator accounts you do not recognise, unfamiliar PHP files in upload folders, core files changed recently, new scheduled tasks, and spam or odd traffic coming from your server.
6. Rotate the secrets that live on the server. If the site was unpatched and online after 20 October, treat everything stored on it as possibly read: the database password in your configuration file, payment and email API keys, and admin passwords. Changing them is cheap. Finding out later that someone kept them is not.

The PHP team has published settings that reduce the risk, such as limiting request sizes and turning off session upload progress. They help while you arrange an update. They are not a fix, and the PHP team says so directly: no configuration change fully mitigates these vulnerabilities.

The bigger lesson: you cannot patch what you do not know you run

PHP2Shell will be patched on most sites eventually. The pattern behind it will not go away. Every website sits on a stack of software the owner never chose consciously: a language runtime, a web server, a database, a control panel, the plugins a developer installed in 2021. Each layer gets its own emergency sooner or later, and the businesses that get hurt are rarely the ones with weak passwords. They are the ones who did not know the layer existed.

Three habits cover most of it:

• Keep an inventory. For every site and app you own: where it is hosted, who can log in to the hosting, which PHP (or Node, or Python) version it runs, and who is responsible for updating it. One page is enough.
• Know who gets the call. When the next PHP2Shell lands, someone needs to own "is this us?" within a day, not after a customer reports a strange redirect.
• Test the whole stack, not just the pages. A scan of your own site tells you what is visible from outside, including version banners like the ones OX Security counted. A proper penetration test goes further and shows what an attacker could actually do with it.

If you are weighing whether to keep an old PHP site going at all, our Next.js vs WordPress comparison covers the maintenance cost honestly, and security patching is a big part of it. For the wider picture of how attacks are changing, see where AI attackers went after phishing and why attackers now log in instead of breaking in. Unpatched internet-facing systems are also one of the main ways ransomware gets into small businesses.

Not sure where your site stands?

This is the work our VAPT service does: we test your website, APIs and servers the way an attacker would, score every finding with CVSS so you know what to fix first, retest for free once you have fixed it, and give you a signed letter to show clients and insurers. If you would rather someone else handled the upgrade, our web development and security and compliance teams do that too.

Tell us what your site runs on and book a discovery call. We will tell you plainly whether PHP2Shell is your problem, and what we would fix first.

Part of our guide to AI security.

Sources: PHP's security advisories and the BleepingComputer report of 21 October 2026 (affected versions, fixes, mitigations, Cloudflare and NCSC statements), watchTowr's PHP2Shell FAQ (timeline, exploitation, unsupported branches), CISA's KEV alert of 26 October 2026, and OX Security's patch tracker (exposure figures). Verified against these sources on 27 October 2026.