PHP2Shell: Two Critical PHP Flaws and What Every Business With a Website Should Do Today

On the morning of Tuesday, October 20, a post on Hacker News claimed that two critical PHP vulnerabilities were about to go public. The post came down, but screenshots spread across social media, and the PHP project moved its security release up by a day. Around 7 AM Pacific on Wednesday, October 21, it shipped the fixes with unusually blunt advice: "There are no complete mitigations, updating is the only safe choice."

If your business has a website, there is a good chance this one touches you. Here is what happened in plain language, how to tell whether you are affected, and exactly what to ask whoever runs your site.

What PHP is, and why this flaw is different

PHP is the programming language behind a large share of the web. W3Techs counts it on 69.3% of websites whose server-side language is known, per Tenable's FAQ. It runs WordPress, WooCommerce, Drupal, Joomla, Magento, and countless custom business tools. Every time a visitor loads one of those pages, PHP on the web server is what builds it.

Most website security news is about a single plugin or theme: one add-on has a bug, the sites that installed it are exposed, and updating that add-on fixes it. The Funnel Builder card-skimming campaign in May was that kind of story. PHP2Shell is different. The bugs are in PHP itself, the engine underneath all of those platforms, so the fix has to happen on the server, and every PHP site counts as affected until its server is updated. "PHP2Shell" is the researchers' nickname; the PHP project refers to the flaws only by their CVE numbers, the industry's tracking IDs for individual vulnerabilities.

What the two flaws do

A PHP web server keeps a pool of worker processes that handle visitor requests one after another. Both flaws come down to PHP mishandling its own memory while it does that work:

• CVE-2026-109618, "RCE via OOM corruption." If PHP runs out of memory partway through setting up a request, it can stop with its internal data only half built. The cleanup routine that runs next then treats that broken data as valid. An attacker who can trigger this on purpose can steer it into running code of their choosing.
• CVE-2026-109619, "RCE via stale global state." Data tied to one request can survive after the memory behind it has been freed, and the next request handled by the same worker can use that leftover data before PHP resets it. Qualys adds that researchers also demonstrated reading chunks of worker memory without logging in, and that memory "can contain passwords, authentication tokens, and API keys."

Both are rated 9.2 on the CVSS v4.0 scale, which is Critical. Early leaked reports said 10.0; the PHP Foundation says that number was incorrect. Neither flaw requires a login. RCE is short for remote code execution: an attacker anywhere on the internet can make your server run commands. In practice that means installing a web shell (a hidden back-door page), planting a card skimmer on a checkout page, copying the customer database, or using your server as a launch point for attacks on others.

PHP says the risk covers "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." It rates the risk highest for mod_php, the older setup that runs PHP inside the Apache web server, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." That last phrase is why a WordPress security plugin cannot stop it: the attack fires before WordPress even starts. PHP-FPM, the more common modern setup, is not off the hook either; Qualys reports that PHP validated code execution against it under the right application conditions.

PHP's advisory does not publish a version range. Cloudflare describes the issue as affecting web servers running PHP 5.4 or later, and Calif, the research firm credited with the discovery, traced the earliest affected code to PHP 5.4.0, released in 2012. In short: if it is PHP and it serves web pages, assume it is affected until it is updated.

How fast this is moving

• Discovery. The PHP Foundation credited Calif, OpenAI, and Wiz, among others, and Calif and Wiz have both said they used AI models in their research, per Tenable.
• The leak. The release was originally planned for Thursday, October 22, and was pulled forward after the CVE numbers leaked on October 20.
• Attack traffic. Cloudflare says it "observed attack traffic targeting our customers," with attackers "mutating the attack payload to try to bypass our protections." watchTowr says its global honeypot network observed exploitation in the wild as of October 21. Huntress, by contrast, had not yet seen exploitation across the networks it monitors as of 10 AM Eastern that morning.
• Official tracking. As of October 21, neither CVE was listed in CISA's Known Exploited Vulnerabilities catalog, per watchTowr, and no confirmed indicators of compromise had been published.
• Fake exploits. Code claiming to exploit PHP2Shell is circulating publicly. Tenable has not verified that any of it works, and JFrog found fake versions posted as pranks. Do not download or run any of it, and be wary of free "PHP2Shell checker" tools from sources you do not know.
• Scale. One researcher's rough estimate, cited by Tenable, is that over 1.3 million internet-exposed servers are potentially vulnerable.

Our read: treat this as actively exploited. The gap between a leak and automated mass scanning is now measured in hours, and attackers do not need to know who you are. They scan everything.

Are you affected? A quick way to tell

What to do today

1. Find every place PHP runs

Start with the obvious one, your main website, then keep going: an old site from a previous redesign still live on a subdomain, a staging copy your developer set up, a client portal, an online booking or ordering tool, and any hosting control panel such as cPanel or Plesk. If you are not sure what you have, that inventory is the first job. The attack surface guide walks through how to find what you have exposed to the internet.

2. Get the fix confirmed in writing

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Send your host or IT provider one plain question: "Is every site and app we run on a PHP build that includes the October 21 fixes for CVE-2026-109618 and CVE-2026-109619?" Ask for a yes in writing, site by site.

Two details make this harder than reading a version number. First, Linux vendors often ship the fix inside their own packages while keeping an older-looking version number, so a host can be patched without showing 8.3.36. PHP says Linux distributions received the patches in advance. Second, the PHP version a server reports at the command line is not always the one actually serving your website. Switching the PHP version in a hosting control panel is not proof either. The person running the server needs to confirm the build that answers web requests.

3. If you are on PHP 8.1 or older, the clock just ran out

"PHP 8.1 and older no longer receive updates from the PHP project," per the advisory. PHP did publish bare-bones source code patches for 7.4, 8.0, and 8.1 for people who compile PHP themselves, and some vendors backport fixes, but for most small business sites the realistic answer is to upgrade. PHP 8.2 reaches end of life on December 31, 2026, so aim for 8.4 or 8.5 rather than 8.2. Old plugins and themes can break on a newer PHP, so test on a copy of the site first. If the upgrade cannot happen quickly, put the site behind a firewall (step 4) or take it offline until it can. A stale site is not worth a breach.

4. Put a web application firewall in front of the site, as a stopgap

A web application firewall (WAF) filters traffic before it reaches your server. Cloudflare deployed rules for the known attack patterns starting October 21 at 3:02 AM UTC (8:02 PM Pacific on October 20), "deployed automatically on all plans with WAF deployed, including Free users." That helps, but it is not a fix. Cloudflare's own guidance is that "customers should patch their PHP repos even with WAF protections," and its CTO called the rules "a STOPGAP only." A WAF also protects only the traffic that passes through it. If attackers can reach your server directly, around the WAF, the protection does not apply, so the server should accept web traffic only from the WAF.

5. Back up, then check for tampering

Take a fresh backup of the site and its database before anything else changes on the server. Then have whoever runs it look for signs that someone got in, going back to at least October 20:

• New or recently modified PHP files in the website folder, especially small, scrambled-looking ones.
• New administrator accounts in WordPress or your other site software.
• Unfamiliar scheduled tasks on the server.
• PHP processes launching shell commands or download tools such as curl or wget, which security researchers expect to be the clearest sign of this attack.
• PHP crash messages in the server logs (often logged as segfaults) around unusual upload requests, and unexpected outbound connections from the web server.

Save the logs before they rotate away. If anything turns up, do not just delete the strange file and move on. Treat it as an incident: isolate the server, preserve the evidence, and follow your incident response plan. Because CVE-2026-109619 can expose server memory, also change the passwords and API keys stored on that server, such as database, email-sending, and payment-gateway credentials.

Why this keeps happening

AI-assisted bug hunting has changed the pace of discovery in 2026. The same dynamic produced 271 AI-found vulnerabilities in Firefox and the record October Patch Tuesday, and the tools that find bugs faster also help attackers turn a published fix into a working attack faster.

The lesson for a small business is simple: a website is a server, not a brochure. Someone has to own its patching all the way down, including the site software, the plugins, and the PHP and operating system underneath them. If you do not know who that person is for your site, this week is a good time to find out. Our patch management guide covers how to make that ownership explicit.

Where this fits

• The Funnel Builder compromise post, for the plugin-level version of this story and a defensive baseline for any business WordPress site.
• The October 2026 Patch Tuesday post, for this month's Windows and Office updates.
• The vulnerability scanning guide, for finding outdated software before attackers do.
• The incident response plan guide, for what to do if the tampering check finds something.
• The web development page, for how we build and maintain business websites, and the cybersecurity page, for where website security fits in the full defense.

We keep watch on issues like this for businesses across Salinas, Monterey, Santa Cruz, Watsonville, San Jose, and the rest of the Central Coast, so they do not have to.

FAQs about PHP2Shell

What is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities in the PHP programming language, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026. Both are rated 9.2 (Critical) on the CVSS v4.0 scale and can let an attacker run their own code on a web server without logging in. CVE-2026-109618 involves how PHP handles running out of memory, and CVE-2026-109619 involves leftover data from one request being reused by the next.

Is my WordPress site affected?

Treat it as affected until your host or IT provider confirms the server's PHP is updated. WordPress runs on PHP, and the flaws are in PHP itself, so the server under every WordPress site is in scope. Calif, the research firm credited with the discovery, says it confirmed pre-login remote code execution against specific versions of popular PHP applications, including WordPress, Drupal, Joomla, and Magento.

Does updating WordPress or my plugins fix PHP2Shell?

No. The fix ships in PHP, which runs on the server underneath WordPress. Cloudflare notes that updating website code or plugins alone does not fix these vulnerabilities, and on the highest-risk setup PHP says the attack can trigger before any application code runs, which is also why WordPress security plugins cannot block it. Keep updating WordPress and plugins anyway, but the PHP update has to happen on the server.

Which PHP versions fix the vulnerabilities?

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026. PHP 8.1 and older receive no official release; the PHP team published source code patches for 7.4, 8.0, and 8.1 for people who build PHP themselves, and some Linux vendors backport fixes into their own packages while keeping older version numbers. PHP 8.2 reaches end of life on December 31, 2026, so an upgrade to 8.4 or 8.5 is the better target.

Is PHP2Shell being exploited?

Early reports say yes. Cloudflare says it observed attack traffic targeting its customers, with attackers changing their payloads to get around its protections, and watchTowr says its honeypot network observed exploitation in the wild as of October 21. Other researchers had not yet seen attacks in the networks they monitor that morning, no confirmed indicators of compromise had been published, and neither CVE was on CISA's Known Exploited Vulnerabilities list as of October 21. Plan as if it is being exploited.

My website is on shared hosting. What should I do?

Your host has to update PHP on its servers, so ask them directly whether every site on your account is on a PHP build with the October 21 fixes, and get the answer in writing. A newer version number in your control panel is not proof on its own, because hosts often ship the fix in their own builds. Take a fresh backup of your site in the meantime, and if your host cannot give a clear answer, that is a reason to move.

Do my office computers need an update for this?

No. PHP2Shell is a server-side flaw. Ordinary office PCs and Macs do not run a web server, so there is no workstation patch for it. The exception is any computer or server in your office that hosts a website or an internal web tool built on PHP; that machine needs the PHP update like any web server. Keep installing your regular monthly Windows and macOS updates as usual.

Sources: PHP security advisory · Cloudflare · Tenable · Qualys · watchTowr · Huntress · JFrog · Google Cloud

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.