PHP2Shell: a critical PHP flaw affects a large part of the web
On October 21, 2026, the PHP project released emergency patches for two critical flaws in its engine, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Their details had leaked the day before, ahead of the planned disclosure date.
PHP runs a large share of websites, including WordPress. For rights holders, that often includes the corporate site, the online store, the subscriber portal or the contact form.
What these flaws allow
Both flaws allow remote code execution without authentication. They are rated 9.2 out of 10 (CVSS v4.0).
- They are in the PHP engine itself: a well-written site is vulnerable too, since the attack does not depend on the application’s code.
- According to the PHP project, every installation that serves web requests is affected, whatever the execution mode (PHP-FPM, Apache mod_php, LiteSpeed, etc.).
- According to Wiz, which discovered the flaws, they also make it possible to read the server’s memory, and so to retrieve passwords, login tokens or API keys.
When it published its alert, the US cybersecurity agency (CISA) had not yet observed any attack. But the leak of the details shortened the time administrators have.
AI sped up the discovery
Wiz researchers reported the flaws to the PHP team on August 24, 2026. They explain that they used AI models to develop the attacks, while the defects themselves were old. It is a trend we follow closely: AI lowers the cost of attacking, and the gap between a known flaw and its exploitation keeps shrinking.
What to do
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later. The PHP project is clear: no workaround is complete, and updating remains the only safe option.
- Older versions (7.4, 8.0, 8.1): they are no longer maintained. The PHP team published minimal patches, but the real answer is to move to a supported version.
- Hosted site: ask your host whether its servers have received the patches. The PHP version is often shown in the control panel.
- Site that cannot be updated right away: CISA recommends taking it offline in the meantime.
- After updating, change the passwords and API keys stored on the server if in doubt.
A hacked site can be used to host illegal content or to send your visitors to scams, under your name. Protecting your server is part of protecting your brand.
Sources
- PHP project, security announcement of October 21, 2026: php.net
- CISA, alert of October 21, 2026: cisa.gov
- Wiz Research, technical analysis: wiz.io
- Huntress, on the October 20 leak: huntress.com
- Help Net Security (October 21, 2026): helpnetsecurity.com
