PHP2Shell: Critical PHP Flaws Let Attackers Take Over Web Servers, Patch Now

The PHP2Shell vulnerabilities are the security story every website owner needs to hear about today. On October 21, the PHP project shipped emergency updates for two critical flaws that can let an attacker run code on a web server without logging in, and the maintainers were blunt about what to do: update now, because nothing else fully protects you. PHP still powers a huge share of the web, from WordPress blogs to custom business apps, so this one reaches far beyond a single product.

What happened with PHP2Shell

The PHP team gave the internet a one day warning. On October 20, it posted a notice on php.net saying a critical security release was coming on Wednesday, October 21 at 14:00 UTC, covering two flaws that it rated 9.2 on the CVSS v4.0 scale. That rating sits near the top of the severity range.

The plan did not hold together quietly. BleepingComputer reported on October 20 that details of the flaws had reportedly leaked ahead of the planned disclosure. Benjamin Harris, the CEO of security firm watchTowr, told the outlet that two remote code execution vulnerabilities in PHP had leaked within the previous hour. The nickname PHP2Shell caught on quickly, because the end result of a successful attack is a shell, meaning command access, on the target server.

The fixed releases landed on schedule. According to the official PHP advisory, the patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory says the bugs "can allow unauthenticated remote code execution" and that all PHP users "are strongly encouraged to update immediately."

The two flaws in plain English

The first bug, tracked as CVE-2026-109618, involves how PHP handles running out of memory. According to the advisory, an out of memory condition can interrupt PHP while data for a web request is only partly set up, and that broken state can be abused.

The second, CVE-2026-109619, is about leftover state. PHP is supposed to clean up everything tied to a request when that request ends. The advisory says some request owned state can survive after its memory has been freed, so a later request handled by the same worker process may end up using it. Attackers love this kind of mistake because it lets one request poison the next.

Was AI involved?

Several outlets tied the discovery to AI tools. Techmeme's coverage linked to an OpenAI post saying the PHP flaws were found using its GPT 5.6 Sol model and that the company expects similar findings to rise sharply. That fits a pattern we have covered before, including Google pausing an open source bug bounty over AI generated reports and the PostgreSQL release delayed by AI code review. The PHP advisory itself is signed by the PHP security team and does not name an individual finder.

Who is affected

The short answer is almost anyone running PHP on a public website. The PHP advisory lists "all PHP installations serving web requests," and names the common setups directly: PHP FPM, Apache with mod_php, php cgi, FrankenPHP and LiteSpeed.

The maintainers single out Apache with mod_php as the highest risk. According to the advisory, there is a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. That detail matters. It means a site does not need a sloppy plugin or a weak password to be exposed. The bug sits underneath the application.

How far back does it go? The PHP homepage does not list affected version ranges and points readers to its GitHub security advisories. watchTowr's Harris told BleepingComputer the flaws are understood to affect PHP versions 5, 6, 7 and 8, and described both as CVSS 10. PHP's own rating is 9.2. Either way, this is a top tier issue.

Older branches are a sore spot. PHP 8.1 and earlier no longer receive official updates, although the advisory says minimal backports were published for 7.4, 8.0 and 8.1. Vendors that package PHP, such as Linux distributions and hosting platforms, received patches early so they could prepare their own updates.

Is anyone being attacked yet

Signals are mixed, which is normal in the first day of a big disclosure. watchTowr told BleepingComputer it had reproduced CVE-2026-109618 but had not seen exploitation in the wild at that point. Later, Cloudflare CTO Dane Knecht said on X that the company was "already observing early attacks," according to BleepingComputer's updated report.

Cloudflare pushed emergency web application firewall rules to block known exploitation methods, and those rules are available to all customers, including free plans. Knecht described the protections as temporary. A firewall rule can block known attack patterns, but attackers tweak their payloads, so it should be treated as a seatbelt, not a fix.

What to do right now

If you run a site, a server or a hosting account with PHP, here is the practical checklist.

Update PHP first

Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. The advisory states it plainly: "There are no complete mitigations, updating is the only safe choice." After updating, restart PHP workers so the old processes stop serving traffic.

If you cannot patch today

The PHP team lists some partial measures that reduce risk while you schedule an update, while warning that they "do not make an installation safe":

• Set a low post_max_size, such as 8M, or 32M if your site needs uploads.
• For CVE-2026-109618, setting memory_limit to -1 is listed as a mitigation, though that removes a useful safety limit, so use it carefully.
• For CVE-2026-109619, set session.upload_progress.enabled to 0 and restart workers.
• On PHP 8.5, set fatal_error_backtraces to 0.

PHP core developer Gina Peter Banyard said on Mastodon that patching is the only real solution, according to BleepingComputer.

Check your host and your stack

If you use shared hosting or a managed WordPress host, check their status page or contact support to confirm they have rolled out the new builds. If you run Docker images, rebuild them on the patched base image rather than assuming they update themselves. Put a WAF in front of the site if you have one available. And if your server still runs PHP 7 or early PHP 8, this is the week to plan an upgrade, because the next critical bug may not come with backports at all.

It also helps to tighten the basics around the server, like the steps in our guide to protecting your online accounts in 10 minutes, since a compromised admin login makes any server bug worse.

Why this one matters

Big infrastructure bugs come in waves, and they tend to hit software that is everywhere and taken for granted. Earlier this month we covered Citrix NetScaler zero days and the Pwn2Own Ireland 2026 results. PHP2Shell is different in scale. It is not one vendor's appliance. It is a language runtime that quietly serves millions of sites, many of them run by small businesses with no security team.

The leak before disclosure made the timing harder. Defenders usually get a clean release and some breathing room. This time, details were circulating before patches shipped, which compresses the window between "fix available" and "mass scanning begins." Expect automated scans for vulnerable servers to ramp up over the next several days.

What to watch next

Watch for three things. First, public proof of concept code, which usually triggers a sharp rise in attacks. Second, statements from large hosting providers and content platforms about whether their fleets are patched. Third, guidance from national cyber agencies, several of which were already warning that some sites may need to go offline until patched.

Note that PHP 8.2 reaches end of life on December 31, 2026, so even sites patched today on 8.2 have a short runway. For more security coverage, see our tech section.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. They can allow unauthenticated remote code execution on web servers running PHP.

Which PHP versions fix the flaws?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal backports were also published for 7.4, 8.0 and 8.1, which no longer get regular updates.

Is a firewall rule enough protection?

No. Cloudflare and others have deployed temporary rules, but the PHP team says updating is the only safe choice. A firewall buys time while you patch.

Do I need to do anything if I just run a WordPress blog on a host?

Check with your host that it has installed the patched PHP version. Most managed hosts will handle it, but it is worth confirming today.