back-arrow

PHP2Shell: The Critical PHP Vulnerability Every Website Owner Must Fix Now 

author icon

Author

Royson Rajan

Published

October 23, 2026

Categories

Cybersecurity, PHP Development

PHP2Shell: The Critical PHP Vulnerability Every Website Owner Must Fix Now 

On 21 October 2026, the PHP project rushed out emergency security updates for two critical flaws, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Within hours, governments across Europe took their own websites offline, security agencies on four continents issued urgent alerts, and Cloudflare reported attack attempts climbing from thousands to millions. 

PHP powers roughly three out of every four websites whose server technology is known, including WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel. If your website runs on PHP, this affects you. This guide explains, in plain English, what the issue is, who is affected, what global authorities are saying, and exactly how to fix it. 

PHP2Shell at a glance 

What: Two flaws in PHP’s request handling that can allow unauthenticated remote code execution — an attacker can run their own code on your server without logging in. 

Severity: 9.2 Critical (CVSS v4.0, PHP security team); NVD lists 9.8 Critical (CVSS v3.1). 

Affected: Essentially every PHP version from 5.4 onwards that serves web requests. 

Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or a patched package from your Linux distribution or host). 

Status: Exploit attempts reported in the wild; public exploit code is circulating. 

Action: Patch PHP, restart PHP services, and check your site for signs of compromise. 

What is PHP2Shell? 

PHP2Shell is the name given to two separate memory-safety bugs in the core of PHP — the engine itself, not any plugin or theme. Because the flaws sit in the way PHP parses incoming web requests, they can be triggered before your application code even runs. That means the security features of WordPress, Laravel, Symfony or any custom application cannot block them. 

CVE-2026-109618 — out-of-memory handling flaw 

When PHP runs out of memory while it is still building the data for an incoming request, its clean-up routine can later treat half-built data as if it were valid. A carefully crafted request can abuse this to corrupt memory and take control of the PHP process. 

CVE-2026-109619 — use-after-free flaw 

Leftover state from one request can point to memory that has already been released. A later request handled by the same PHP worker can then use that “freed” memory. Besides code execution, the PHP team also confirmed this flaw can leak memory contents — which may include sensitive data such as session information or credentials. 

Why it is so serious 

  • No login required. An attacker only needs to send web requests to your site. 
  • No user interaction. Nobody has to click a link or open a file. 
  • Framework-independent. As one industry analysis put it, “a heavily secured custom system is just as vulnerable as a standard WordPress installation.” 
  • Hard to spot. CrowdStrike verified that a single unauthenticated request can open a shell inside an Apache mod_php worker with no visible crash or log trace. 
  • Huge exposure. Estimates put internet-exposed, potentially vulnerable hosts at over 1.3 million, and Cisco Talos estimates around half of PHP systems may never be patched. 
PHP2Shell Critical Vulnerability Alerts (1)

Timeline: how PHP2Shell unfolded 

Date (2026) What happened 
17 October Amazon Threat Intelligence records an exploit attempt on its MadPot honeypot network — four days before public disclosure. 
20–21 October A working proof-of-concept is leaked through an anonymous Hacker News post, forcing PHP maintainers to abandon their planned schedule. 
21 October PHP releases emergency fixes: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare deploys WAF rules at 03:02 UTC for all plans, including free. 
21–22 October Government and public-sector websites in the Netherlands, France, Germany, Belgium, Finland and elsewhere are taken offline as a precaution. National cyber agencies issue alerts. 
22 October onwards Hosting providers roll out patches; attack attempts reported by Cloudflare, watchTowr, Amazon and others continue to grow. 

Who is affected? 

In short: anyone running a website or web application on PHP. That includes small business websites, ecommerce stores, membership sites, intranets, CRMs and internal tools. 

Affected PHP versions 

PHP branch Status What you should do 
8.5.x Fixed in 8.5.12 Update to 8.5.12 or later and restart PHP 
8.4.x Fixed in 8.4.27 Update to 8.4.27 or later and restart PHP 
8.3.x Fixed in 8.3.36 Update to 8.3.36 or later and restart PHP 
8.2.x Fixed in 8.2.35 Update to 8.2.35 or later and restart PHP 
7.4 – 8.1 No official release; source backports only Upgrade to PHP 8.2+ or use a vendor/distribution patched build 
5.4 – 7.3 End-of-life; no fix Upgrade urgently, or take the site offline until upgraded 

Affected server setups 

PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. Apache mod_php is considered the highest risk, because an unauthenticated request can trigger the exploit before any application code runs. 

Affected platforms 

Researchers confirmed pre-authentication remote code execution against specific versions of popular PHP applications, including WordPress, Drupal, Joomla and Magento. Ecommerce platforms such as WooCommerce, Magento and Shopware are considered especially high-risk because they process customer and payment data. Shopify, Wix and Squarespace stores are managed by those platforms and are not directly exposed in the same way. 

Your risk depends on your hosting 

Hosting type Who patches? Your action 
Managed WordPress (Kinsta, WP Engine, Pantheon, Pressable, etc.) Your host Confirm with your host that the 21 October fix is applied 
Shared / cPanel hosting (GoDaddy, Hostinger, Namecheap, etc.) Your host Check your host’s status page; open a ticket if unclear; switch to PHP 8.2+ in your control panel if you are on an older version 
VPS, cloud or dedicated server You (or your developer) Update PHP packages and restart PHP-FPM/Apache immediately 
Docker / containers You Rebuild images from patched base images and redeploy 

What global stakeholders are saying 

The response to PHP2Shell has been one of the broadest coordinated security alerts in years. While sources differ on how widely the flaws have been successfully exploited, every authority agrees on one thing: patch immediately. 

The PHP project and PHP Foundation 

The PHP security advisory calls the update “the only complete fix” and identifies mod_php as the highest-risk setup. The PHP Foundation says it demonstrated remote code execution on mod_php with default settings. 

United States 

  • CISA urged immediate patching, a full inventory of PHP (including copies embedded in other products) and taking systems offline if they cannot be updated. 
  • NSA directed US government operators to patch immediately, increase logging, replace end-of-life PHP and take unpatchable systems offline. 

Europe 

  • CERT-EU advised patching immediately or isolating internet-facing applications until the fix is applied and verified. 
  • UK NCSC told organisations to identify all PHP, apply hardening, take systems offline if mitigations cannot be applied in time, and hunt for signs of compromise. NHS England rated the threat High and assessed future exploitation as “highly likely”. 
  • Germany’s BSI urged immediate installation of fixes; its vice-president Thomas Caspers noted the situation “seems a little bit more complicated than expected.” 
  • CERT-FR (France), INCIBE-CERT (Spain), CERT Polska and Switzerland’s NCSC all issued critical alerts calling for urgent patching and service restarts. 
  • Slovenia set the strictest deadlines: identify all PHP systems within 24 hours, patch internet-facing systems within 48 hours and all others within 7 days. 

Asia-Pacific and beyond 

  • Japan: Prime Minister Takaichi asked operators to check for PHP and patch quickly, noting that taking a website offline is an effective step if patching is difficult. JPCERT/CC published indicators to look for in server logs. 
  • Singapore’s CSA reported widespread exploitation attempts and multiple proof-of-concept exploits. HKCERT rated the flaws “Extremely High Risk”. 

Security and infrastructure companies 

  • Amazon observed exploitation attempts from 17 October and recommends investigating logs from that date. 
  • Cloudflare deployed protective WAF rules for all customers, but stresses they are a stopgap — patching is still required. Its CEO reported attack attempts rising from thousands to millions. 

Which websites were taken offline? 

In an unusual move, several governments and large organisations chose to take their own websites offline rather than risk exposure while they patched. Reported shutdowns, mostly on 21–22 October 2026, include: 

  • Netherlands: DigiD (the national digital ID login), MijnOverheid, Overheid.nl, the Tweede Kamer (House of Representatives) and even the Dutch National Cyber Security Centre’s own website. The Port of Rotterdam and the KNVB (Dutch football association) were also reported offline. 
  • France: The Interior Ministry took several prefecture websites offline while awaiting a security fix. 
  • Germany: ITZBund temporarily disabled several federal websites as a preventive measure. 
  • Belgium: The Foreign Affairs Ministry’s websites went offline after reports of attacks exploiting the flaws. 
  • Finland: Government IT provider Valtori temporarily shut down public web services as a precaution. 
  • Wikimedia Foundation: Took some PHP-based systems offline until they could be safely patched. 
  • Internet Archive: Reported to have taken precautionary action. 
  • Uberspace (German web host) switched PHP off across its platform as a precaution, and some Australian government sites also went offline. 

Most of these organisations described their shutdowns as precautionary, and several reported no confirmed breach. The lesson for businesses is clear: if national governments judged the risk serious enough to go offline, an unpatched business website should not wait. 

How to fix PHP2Shell: step-by-step 

  1. Find out which PHP version you run. In WordPress, go to Tools → Site Health → Info → Server. Most hosting control panels also show the PHP version. Remember that Linux distributions often backport fixes without changing the version number, so confirm with your host. 
  1. Update PHP. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later), or install your distribution’s patched package. On shared hosting, your host applies the update — check their status page or open a support ticket. 
  1. Restart PHP services. Restart PHP-FPM, Apache or LiteSpeed after updating. Running processes keep executing the old, vulnerable code until they are restarted. Rebuild and redeploy any Docker containers. 
  1. Upgrade end-of-life PHP. If you are on PHP 8.1 or older, plan an immediate upgrade to PHP 8.2+ and test your themes, plugins and custom code. If that is not possible right away, authorities recommend taking the site offline until it is. 
  1. Apply temporary mitigations if you cannot patch today. These reduce risk but do not close the hole: 
  • Set session.upload_progress.enabled = 0 in php.ini and restart PHP (WordPress does not use this feature). 
  • Ask your server administrator to review memory_limit and upload/POST size limits, as recommended in PHP’s advisory. 
  • Put your site behind a web application firewall such as Cloudflare (rules are available on all plans) and make sure managed rules are set to block, not just log. 
  1. Check for signs of compromise. Review logs from 17 October 2026 onwards for unknown admin users, new or modified PHP files, web shells, unusual outbound connections, malformed or unusually long PHPSESSID cookies, and PHP workers that crash or restart repeatedly. 
  1. Rotate credentials. Because CVE-2026-109619 can leak memory, change admin passwords, database passwords, API keys and payment gateway keys if your site was exposed while unpatched. 
  1. Keep a website maintenance plan in place. PHP2Shell shows how quickly a single core vulnerability can affect millions of sites. Regular updates, monitoring and backups are your best long-term protection. 

Quick checklist by platform 

Platform Key actions 
WordPress / WooCommerce Confirm PHP 8.2+ patched build with host; disable session upload progress; scan for unknown admins and modified files; rotate WooCommerce payment API keys 
Magento / Adobe Commerce Patch PHP-FPM and restart; check for skimmers and web shells in pub/ and app/ folders; review admin users; rotate integration tokens 
Laravel / custom PHP Update server PHP and rebuild containers; restart queues and workers; rotate .env secrets; review logs for suspicious POST requests 
Drupal / Joomla Patch PHP; review recent file changes and new user accounts; ensure core and extensions are also up to date 

Frequently asked questions 

Do I need to update WordPress to fix PHP2Shell? 

No. PHP2Shell is a flaw in PHP itself, not in WordPress. The fix is a PHP update on your server. However, keeping WordPress, plugins and themes updated remains good practice. 

Is my Shopify store affected? 

Shopify is a fully hosted platform, so you do not manage PHP and are not directly exposed in the same way. Any separate PHP-based sites or apps you run are still at risk. 

My host says I am protected. Is that enough? 

If your host confirms the 21 October patch is applied and PHP has been restarted, you are protected from these flaws. It is still wise to check your site for any signs of compromise from before the patch. 

Is a firewall like Cloudflare enough on its own? 

No. WAF rules are a valuable stopgap, but attackers can sometimes reach your server directly. Patching PHP is the only complete fix. 

I am on PHP 7.4. What should I do? 

PHP 7.4 to 8.1 receive no official release. Upgrade to PHP 8.2 or later as soon as possible, testing your site for compatibility. If you cannot, consider taking the site offline until it is upgraded. 

Need help? Atlas SoftWeb can secure your website today 

Not sure which PHP version your website runs, whether your host has patched it, or whether your site was targeted before the fix? Atlas SoftWeb can take care of it for you. 

Since 2011, Atlas SoftWeb has built and maintained WordPress, WooCommerce, Magento, Laravel and custom PHP websites for businesses in more than 50 countries. Our 50+ member team includes web developers, server specialists and QA engineers who handle security updates like PHP2Shell every day. 

Our PHP2Shell Emergency Response Service 

Free vulnerability check — we confirm your PHP version, server setup and patch status. 

Emergency patching — PHP update and service restart on VPS, cloud and dedicated servers, or coordination with your host on shared hosting. 

PHP 8.2+ upgrade — safe upgrades from end-of-life PHP with full theme, plugin and custom code compatibility testing on staging. 

Compromise check and clean-up — log review, malware and web-shell scanning, admin user audit and credential rotation. 

Firewall setup — Cloudflare WAF configuration and hardening of php.ini and server settings. 

Ongoing protection — website maintenance plans with monthly updates, monitoring, backups and security reporting. 

Don’t wait for your website to become the next headline. Contact our team today for a free PHP2Shell check. 

Atlas SoftWeb is a Google Partner agency, an official Shopify Partner and rated 4.9 on Clutch. 

References 

  1. Tenable – php2shell FAQ — https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote 
  1. CISA – Critical Vulnerabilities in PHP Require Immediate Patching — https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching 
  1. Rapid7 – CVE-2026-109618 and CVE-2026-109619 — https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ 
  1. Codeable – PHP Security Release: What WordPress Site Owners Need to Do — https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/ 
  1. PHP2Shell Assessments: CISA, ENISA, Cloudflare, AWS — https://phpvulnerabilities.app/assessments/ 
  1. WorthvieW – PHP2Shell Crisis: Which Major Websites Went Offline — https://www.worthview.com/php2shell-crisis-which-major-websites-went-offline-and-why/ 
  1. Techzine – Why PHP2Shell affects every company — https://www.techzine.eu/blogs/security/145168/php-shuts-the-internet-why-php2shell-affects-every-company/ 
  1. watchTowr – PHP2Shell FAQ — https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ 
  1. Sansec – PHP2Shell research — https://sansec.io/research/php2shell 

Turn Your Ideas Into Digital Growth

Discover how Atlas SoftWeb transforms your website, marketing, and technology into a powerful growth engine that drives real business results.

Start a conversation
clutch
Group 518

4.9
goodfirms
Group 518

4.9
googlelogo
Group 518

4.5
glass
Group 518

4.7
trustpilot
Group 518

3.8
calendar
Get in Touch