A severe security vulnerability in PHP, one of the internet’s most popular programming languages, caused an urgent update from developers. The problems, which go by the name PHP2Shell, could potentially allow malicious actors to execute code on affected servers without proper authentication, leading to information disclosure and other issues.
The PHP development team issued emergency security updates on October 21, 2026, to address two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Security experts recommend that organizations using affected PHP versions apply the updates to mitigate the risks.
The issue has created an international security concern because PHP is used to power popular content management systems including WordPress, Drupal and Joomla. The vulnerability affects the programming language itself, meaning that even hardened websites that don’t run popular CMS plugins or applications may still be at risk.
What Is the PHP2Shell Security Vulnerability?
PHP2Shell is the name given to two closely related security problems discovered in PHP. According to security researchers, both issues are the result of memory management errors, which could have allowed unauthenticated code execution and information disclosure.
The first problem is an out-of-memory condition, and the second is use-after-free of program state. The combination of the two could potentially allow an unauthenticated attacker to run code on the targeted server.
Depending on the circumstances, an attacker could potentially read information from the memory of a PHP process. The exact contents would depend on the specifics of the attack and the process state at the time of the breach.
The problems were assigned a CVSS v4.0 score of 9.2 (“Critical”).
Unlike many other classes of programming errors, PHP2Shell affects the programming language itself. PHP is frequently used on websites, so administrators need to make sure that their PHP version is up-to-date, rather than only focusing on whether their WordPress plugins or other applications are current.
Why the PHP Security Vulnerability Is a Serious Problem
PHP is an important part of the modern internet. Web applications, online stores and content management systems use the language to handle requests and deliver information to millions of users.
An attacker could potentially use a working exploit to damage a website, steal data or spread malware. More importantly, however, is the fact that this vulnerability could give an outside party remote access to a server process.
1. Remote Code Execution Risk
The most important single issue with the vulnerability is that it allows remote code execution. This means that an attacker could potentially issue commands to a server process without having to authenticate in any way.
Depending on the permissions of the process, this could allow an attacker to view or modify files on the server, launch additional attacks or processes, and potentially pivot to other systems.
2. Sensitive Information Exposure
The memory of a PHP process can contain sensitive information, such as authentication tokens, credentials and other data. Depending on the circumstances, that information could be captured by an attacker.
The exact value of the information exposure risk depends on the contents of the memory at the time of the attack, but it could be a significant breach of privacy or security.
3. Impact on Website Functionality
Malicious use of the PHP2Shell vulnerability could potentially interrupt the operations of a website or modify its contents in unauthorized ways. For businesses, this could mean both direct and indirect losses.
Depending on the target website, an attacker could shut down or damage the system, leading to financial losses or requiring substantial resources to fix.
For online businesses, an interruption in operations or the disclosure of proprietary information could be significantly damaging. Even if the website itself is not of interest to an attacker, a shared hosting environment could allow an adversary to use the vulnerability to reach other websites.
4. Risks for Business Applications
The ability to remotely access a server with the permissions of the PHP process can be a significant risk for businesses. Depending on the setup, that access could potentially be used to view or modify data that is not publicly available.
This vulnerability should be considered a server security issue rather than a mere website concern. Website administrators should ensure that the entire server environment is secure rather than only addressing the application layer.
Which PHP Versions Are Vulnerable to PHP2Shell?
The security issues have been addressed through the release of new PHP versions. The PHP development team has listed four affected branches along with the first PHP versions that address the problems.
PHP branch Affected versions First fixed in
PHP 8.5 All versions before 8.5.12 PHP 8.5.12
PHP 8.4 All versions before 8.4.27 PHP 8.4.27
PHP 8.3 All versions before 8.3.36 PHP 8.3.36
PHP 8.2 All versions before 8.2.35 PHP 8.2.35
Administrators should update their production environments to the fixed versions or the most recent stable release that addresses the security problems.
PHP versions prior to PHP 8.2 are also affected but are no longer officially supported. Some operating system vendors provide long-term support for older versions, however. Administrators should consult their hosting providers or system vendors to find out if they can obtain updated versions of PHP.
Why WordPress Website Owners Should Be Concerned
WordPress uses PHP to process requests and run its core functions. That means that the security of PHP is an important consideration for businesses and individuals that use the popular blogging and website building platform.
Website owners, bloggers, publishers and businesses should be aware that the problem is not necessarily with WordPress itself, but rather the underlying programming language.
Updating WordPress Core may not be sufficient for all website owners, as the issue needs to be addressed at the PHP level. WordPress website owners should make sure that the PHP version on their hosting account is up-to-date, that their hosting provider has applied the security update, or that their provider does not support PHP anymore.
Website owners who use managed WordPress hosting should contact their providers and make sure that the issue has been addressed on the backend.
What Website Owners Can Do About PHP2Shell
Security researchers advise prioritizing the systems that are currently at risk of being hacked, particularly those that are exposed on the internet.
Step 1: Vulnerable PHP Installation Inventory
Administrators should create an inventory of all PHP-based servers, applications and containers that are in use in their organization. This includes production servers, staging environments and other systems that may not receive regular maintenance.
Step 2: Security Update Deployment
Administrators should apply a PHP security update using the methods recommended by their hosting providers or system administrators. It is critical to ensure that the update is actually deployed and that the system is using the newly updated PHP version.
Step 3: Service Restart
After the update is deployed, PHP-FPM, web servers and other long-running processes may need to be restarted in order to use the newly updated code.
Step 4: Suspicious Activity Assessment
System administrators and security teams should assess webserver and application logs for evidence of compromise, anomalous process behavior, unauthorized modifications or other issues.
If there is a concern about a potential breach, security teams should investigate the matter, preserve evidence and follow the appropriate incident response procedures.
Step 5: Temporary Protection Considerations
Web application firewalls or similar security tools may provide some protection, at least until a full update can be deployed. Cloudflare has announced protections for the PHP2Shell vulnerabilities, for example.
Those protections should not be considered a replacement for PHP-level security updates, however. Organizations considering delaying the update should consider whether internet-facing services will be removed from public access until the updates can be deployed.
Cloudflare and Other Security Experts Discuss PHP2Shell
The security industry has responded to the release by discussing the issue on technical forums and social media. Cloudflare announced that it had deployed protections in its web application firewalls for the newly discovered vulnerabilities, for example.
Wiz and several other security research teams have also shared technical details about the issues. This kind of collaborative response is important, as it can ensure that all interested parties are aware of the problem.
Vendors can take steps to mitigate the problem, such as deploying application-level protections or restricting server access. In addition, organizations that are affected by the vulnerability should consider updating their production environments to the latest PHP versions.
While the collaborative response is beneficial, each organization should still be aware of its own responsibilities and update its systems.
The PHP2Shell Incident Is a Problem For Your Business
The nature of the problem means that businesses should take PHP security seriously. Organizations typically invest more resources into application-layer security, such as website protection, than server security.
Businesses may have invested resources into application-layer protections, including website application firewalls or similar tools. Those protections may not be sufficient against the described flaw.
The problem with PHP2Shell is that it represents a fundamental security risk for many businesses, much like a similar vulnerability that was disclosed in 2021.
The primary concern for businesses is ensuring that all production servers are updated, protected and monitored. This includes both website-focused servers and generic server environments.
The Bottom Line
PHP2Shell is a class of vulnerabilities that affects the programming language used to power many websites. The issues could potentially allow an attacker to execute unauthorized code on the server or view information that was not intended to be exposed.
PHP updates released on October 21, 2026, address the issues, but the responsibility of website owners and system administrators is to update their production environments. Website owners should update their PHP versions and ensure that no unauthorized changes have been made to their systems.
As businesses increasingly rely on the internet, the security of underlying technologies such as PHP is of paramount importance.
