If your website runs on PHP, this is the week to stop putting off server updates. A pair of critical flaws in PHP, nicknamed PHP2Shell, can let an attacker take over a web server without a password, a login or any help from the site’s own code. Patches are out, proof-of-concept exploits are public and security firms are seeing attacks.
We work with PHP every day, so we’ve pulled together what matters for business owners: what happened, who is exposed & the concrete steps to take. No scare tactics, just the plan.
Let’s Understand What happened
PHP2Shell was found by researchers from Calif, OpenAI and Wiz. It covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP team rates both 9.2 out of 10 (critical) under CVSS v4.0. At least one security firm, watchTowr, scores it a full 10.
The disclosure did not go to plan. Fixes were due later in the week, but details leaked online on October 20 and a proof-of-concept video briefly went public. The PHP Foundation pulled the release forward and shipped emergency patches on Wednesday, October 21, 2026. By then, exploit code was circulating on GitHub.
The researchers themselves have called these some of the most severe bugs ever found in PHP. The underlying weaknesses had been sitting in the language for years. What changed is that AI-assisted research made a very complicated exploit chain practical to build.
Why does PHP matter so much?
PHP is the server-side language behind a huge share of the web. WordPress, Drupal, Joomla, Magento & Laravel all run on it along with countless custom business portals, booking systems & online stores. It is the part of your website that processes forms, talks to the database & builds each page before it reaches the visitor.
That reach is why PHP2Shell is a big deal. This isn’t a bug in one plugin or one CMS. It’s in the engine underneath all of them.
Understanding Two Flaws in Simple Language
- CVE-2026-109618 – When PHP runs out of memory at just the wrong moment, it can stop halfway through setting up a request. The cleanup step then treats that half-built data as valid, which corrupts memory.
- CVE-2026-109619 – A fatal error can leave PHP holding references to memory it has already freed. The next request handled by the same worker can then reuse that memory (a “use-after-free”).
In practice, either flaw can let an attacker send crafted web requests and run their own commands on your server with the web server’s permissions. Researchers have also shown the bugs can crash PHP workers, read files and leak chunks of server memory, which may contain passwords, session tokens and API keys.
Is it being exploited?
Yes. Several security companies have reported attack attempts:
- Amazon’s threat intelligence team spotted an exploitation attempt on its honeypot network on October 17, four days before the patches were public.
- Cloudflare saw attack traffic aimed at its customers and watched attackers tweak their payloads to try to slip past its firewall rules.
- watchTowr reports exploitation in the wild and Patchstack and others saw attempts on release day.
To keep this in proportion: so far, the reporting confirms widespread attempts. How many servers have been compromised is still unclear. That uncertainty is a reason to move fast instead of waiting.
Who is affected?
Researchers believe the flaws reach back to PHP 5.4, which means almost every PHP site serving web traffic is in scope. That includes all the common setups:
- PHP-FPM
- Apache with mod_php (reported to be the most dangerous configuration)
- php-cgi
- FrankenPHP
- LiteSpeed
The scale is striking. Qualys says it found roughly 166 million PHP installations across its customer base, most of them facing the internet and about 70% of those with a known version are on end-of-life branches that no longer get official fixes.
If you’re on shared hosting, managed WordPress hosting, a VPS, cloud servers or a custom PHP application, assume you’re exposed until someone confirms otherwise.
Patched PHP versions
Update to one of these releases (or anything newer on the same branch):
| PHP branch | Patched version |
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
The PHP team has been clear that no configuration tweak fully closes these holes. Updating is the only real fix.
Still on PHP 7.x, 8.0 or 8.1?
These versions are end-of-life, so there is no official patch for them. Your options are a security backport from your Linux distribution or hosting vendor or upgrading to a supported branch. For many older business applications, that upgrade means code changes, which is where an experienced PHP development company earns its keep. They are auditing deprecated functions, updating dependencies and testing the site properly before it goes live on PHP 8.x.
What to do right now: a step-by-step checklist
Step 1 – Find out which PHP version you are running
Check your hosting control panel, server config or deployment pipeline. One catch worth knowing is that the php command-line version can differ from the version PHP-FPM or Apache uses to serve your site, so check the one handling web requests. If you use a temporary phpinfo() page to check, delete it straight after.
Step 2 – Update PHP today
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. On managed hosting, ask your provider in writing to confirm the patch has been applied to your server.
Step 3 – Restart every service that loads PHP
This step is easy to miss. Running PHP processes keep the old, vulnerable code in memory until they restart and CVE-2026-109619 specifically abuses state carried between requests in long-running workers. Restart PHP-FPM, Apache, LiteSpeed and any other PHP workers after updating.
Step 4 – Confirm the fix worked
Don’t assume. Searchlight Cyber has released an open-source tool, php2shell-scanner, that tests whether a host is still exposed and most major vulnerability scanners have added checks.
Step 5 – If you can’t patch immediately, reduce exposure
These measures buy time but are not a fix:
- Put the site behind a web application firewall. Cloudflare’s free and paid WAF plans have had protections on by default since October 21.
- Set session.upload_progress.enabled=0 and restart every worker.
- On PHP 8.5, also set fatal_error_backtraces=0 and restart.
- Restrict access to admin areas and add rate limiting.
Then schedule the real update as soon as possible.
Step 6 – Look for signs of compromise
Go through server and access logs for unusual POST requests, unexpected processes or commands, new admin accounts, modified core files, unfamiliar cron jobs, odd outbound connections and unexpected uploads, especially from mid-October onward.
Step 7 – Rotate secrets if anything looks off
Because PHP2Shell can leak server memory, credentials may be exposed even without obvious signs of a break-in. If you see anything suspicious, reset admin passwords, database credentials, API keys, SSH keys and hosting-account logins and force active sessions to log out.
Step 8 – Update the rest of the stack
PHP is one layer. Bring your CMS core, plugins, themes, frameworks and libraries up to date too, so you’re not closing one door and leaving another open.
For business owners: questions to ask your team today
You don’t need to know what a use-after-free is. You do need clear answers to these:
- Which PHP version is our website running and has it been updated to a patched release?
- Were the PHP services restarted after the update?
- Has anyone checked the logs for suspicious activity since mid-October?
- Are our CMS, plugins, themes and frameworks current?
- Do we have recent backups and have we tested restoring them?
- Who owns emergency security responses and how quickly can they act?
If your site takes payments, handles customer accounts or runs bookings, treat this as a same-day job.
When to bring in PHP development services
Plenty of businesses can patch a modern PHP 8.x server in an afternoon. Others will hit a wall: a legacy app stuck on PHP 7.4, a customized Magento store or a site nobody has touched since the original developer left. That’s when professional PHP development services make the difference between a quick fix and a long outage.
A reliable PHP development company can help you:
- Audit every server and application to find out where PHP is running and which versions are in use
- Upgrade legacy code from PHP 7.x or 8.0/8.1 to a supported, patched branch without breaking functionality
- Apply patches, restart services and verify the fix with scanning tools
- Investigate logs and clean up if there are signs of compromise
- Put ongoing maintenance in place so the next critical patch goes out in hours, not weeks
PHP2Shell also exposes a bigger issue. If most PHP installations are running unsupported versions, the problem isn’t a single bug; it’s deferred maintenance. Treating PHP development services as an ongoing partnership rather than a one-off project is the best protection against the next emergency.
The bottom line
PHP2Shell is serious because it lets attackers in without logging in, it affects almost every PHP version in use, working exploits are public and attacks have already started. The fix is straightforward, i.e. update PHP, restart your services, check for signs of trouble and confirm with your host that everything is patched.
If you are not sure where your site stands or you are running an older PHP version that can’t simply be updated, talk to a trusted PHP development company now. A few hours of work this week is far cheaper than recovering from a breach.
