PHP2Shell Explained: The Critical PHP Flaw Every Website Owner Needs to Act On

Quick Answer: PHP2Shell is the name given to two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. Both score 9.2 on the CVSS v4.0 scale. The only complete fix is to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor-patched build), then restart your web services. Updating WordPress or plugins does not fix it.

What is PHP2Shell?

PHP2Shell is the nickname for two vulnerabilities disclosed on October 21, 2026, in the PHP language runtime that powers a huge part of the web. WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel sites all run on PHP, which is why this one is getting so much attention.

The two flaws are tracked as:

• CVE-2026-109618: an out-of-memory condition that can leave request data half-initialised, which PHP's cleanup then treats as valid. This can lead to remote code execution.
• CVE-2026-109619: stale internal state that survives after its memory is freed, so a later request handled by the same worker can pick it up. This can lead to code execution or leaking memory contents.

In plain English: a specially crafted web request can trick PHP into misbehaving before your own application code even starts. That is why it does not matter how well your site is coded.

Why it matters even if your site is "up to date"

This is the point most business owners miss. The bug is in PHP, not in WordPress or any plugin. Cloudflare stresses that updating website code or plugins alone does not fix it, so the server's PHP has to be updated, either by you or by your host. Researchers demonstrated the attack against WordPress, Drupal and Joomla, though they say exploitation does not depend on any of them.

The flaws also allow memory disclosure in some conditions, which could expose passwords, tokens and API keys that were being handled by the server. That makes a quick update more important than the "complexity" rating might suggest.

How serious is it, really?

Both flaws carry a CVSS v4.0 score of 9.2, which is critical. The scoring notes that exploitation depends on details such as memory allocation, how PHP was built and how workers are scheduled, so it is not a button anyone can press on any server. But it has gone well beyond theory:

• Researchers have shown working remote code execution for both flaws.
• Technical details leaked ahead of the planned coordinated release, according to SecurityWeek.
• Amazon's threat team reported an exploitation attempt on its honeypot on October 17, four days before public disclosure, per Help Net Security.
• Cloudflare says it saw attack traffic aimed at its customers, including attempts to change payloads to get around its rules.

Treat this as an active threat, not a "patch next month" item.

Who is affected?

Any PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is considered the most urgent case. Several sources say affected releases go back to PHP 5.4.

Many sites are running old versions. Qualys, using its anonymised data, counted roughly 167 million PHP installations, about 73% of them internet-facing. Of those with a known version, only about 28% were on supported branches (8.2 to 8.5), while about 71% were on end-of-life versions. It also reported that only about 199,000 had been patched in the first 12 hours.

Which PHP versions fix it?

The fixed releases are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and earlier are no longer supported upstream. The PHP project published limited source backports for 7.4, 8.0 and 8.1, mainly for people who build PHP themselves. If you use a Linux distribution or a long-term-support vendor, ask them for a patched package. Be aware that vendor fixes can keep an older-looking version number, so check the vendor's security advisory rather than the version alone.

What to do today

1. List where your sites live. Shared hosting, a VPS, a managed WordPress host, a container or a cloud server? The steps differ for each.
2. Find the PHP version actually serving your website. Do not rely on running php -v on the server. Qualys warns it can report a different PHP installation from the one that serves web traffic. Check your hosting control panel, ask your host, or ask your developer to check each installation, including containers and bundled copies.
3. Update PHP and restart services. Move to a fixed release, then restart Apache, PHP-FPM and any long-running PHP workers. On shared or managed hosting, ask your provider to confirm in writing that your account is patched.
4. Plan an upgrade if you are on PHP 8.1 or older. Test on a staging copy first, because old plugins and themes sometimes break on newer PHP. This is a good moment to retire abandoned plugins.
5. Keep your firewall on, but do not rely on it. Cloudflare has deployed rules for the known attack patterns, including on its free plan, and says its WAF is not a substitute for patching. If you are on a paid plan, confirm the ruleset is in block mode.
6. Look for signs of trouble. Check for unfamiliar files, new admin users, modified core files, unexpected outbound connections and unusual traffic spikes since mid-October.
7. Rotate secrets if you suspect exposure. Because memory disclosure was demonstrated, change database passwords, API keys and admin passwords on any site you cannot confirm was safe, and make sure backups are recent and stored away from the server.

If you cannot patch right away

Patching is the only complete fix. If a delay is unavoidable, PHP's own guidance lists temporary measures, such as disabling session upload progress (session.upload_progress.enabled=0), limiting upload and POST sizes, and blocking multipart requests where your application does not need them. Some of PHP's other suggestions, such as changes to memory limits, carry trade-offs and can create resource problems, so have your developer or host apply them carefully. The UK's NCSC has urged organisations to consider taking unpatched systems offline if they cannot be protected.

What we do not know yet

Public details are still limited, and some early reports contradict each other, for example on whether specific products are vulnerable and how widespread exploitation is. Vendors including network equipment makers are still checking their own products. Expect updates over the coming days, and check again before you finish your remediation.

A note on how it was found

The researchers credited on the disclosure site include Wiz Research, OpenAI Codex Security and Calif, with Google's Gemini team assisting with discovery, coordination and patch verification. It is one more sign that both attackers and defenders now have AI tools helping them find bugs, which makes fast patching a routine habit instead of an occasional chore.

FAQs

Is my WordPress site affected by PHP2Shell? If it runs on an unpatched PHP version, yes, it can be exposed, because the flaw is in PHP itself, not in WordPress. Ask your host which PHP version your site uses and whether it has been patched.

Will updating my plugins fix it? No. Plugin and theme updates are still good practice, but this needs a PHP update at the server level.

Which PHP version should I be on? At minimum 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a build your vendor confirms is patched. If you are on 8.1 or older, plan an upgrade.

Does Cloudflare protect me? Cloudflare has deployed WAF rules for known attack patterns, including for free-plan users, but says it is not a replacement for updating PHP.

What if my host has not patched yet? Contact them, ask for a timeline, and consider interim mitigations or moving your site to a provider that has patched. Do not wait quietly.

Need help checking your PHP version or securing your site?

Websigntist provides website security, hosting and maintenance for businesses worldwide. If you want someone to check your PHP version, patch the server and review your site, get in touch.