PHP2Shell Explained: Critical PHP Flaws (CVE-2026-109618) and How to Fix Them

PHP2Shell Explained: The Critical PHP Flaws Behind This Week’s Website Outages

Published: October 22, 2026

If you tried to open a favourite website this week and found it “down for maintenance,” there’s a good chance PHP was the reason. Two critical vulnerabilities, nicknamed PHP2Shell, have sent website owners, governments and hosting companies scrambling. Here’s what happened, why it matters, and what you should do.

What happened?

The PHP development team released emergency security updates to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers execute code remotely on web servers without logging in. The fixes landed on October 21, 2026, and PHP rates both flaws 9.2 (critical) and fixed them in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Why is this such a big deal?

PHP is everywhere. Security experts estimate roughly 70% of the world’s websites use PHP to power their platforms. That includes many blogs, online shops and business sites built on content management systems like WordPress.

The flaws are also unusually dangerous. Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The attacker doesn’t need a password, so a vulnerable server can be attacked just by receiving a crafted web request.

What are the two vulnerabilities?

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid.

• CVE-2026-109619: A second flaw with the same severity rating, which the demonstrated attack reached through PHP’s session-based upload progress feature.

In plain language, both let an attacker trick PHP into mishandling memory, and under certain conditions that can end in them running their own code on your server.

Who is reacting?

The response has been global:

• The Wikimedia Foundation said it took down a number of systems as a precaution until they could be safely patched, leaving parts of Wikipedia unreachable on Wednesday. thecyberexpress

• European authorities took selected government websites offline while they assessed the risks and prepared fixes.

• The UK’s NCSC urged organisations to take immediate action.

• Japan’s Prime Minister urged people to check whether their public websites ran on PHP.

Researchers at Calif and Wiz uncovered the flaws, and the findings were credited to AI-assisted vulnerability discovery. That makes this a notable example of AI changing how security bugs get found.

Are old PHP versions affected too?

Yes, and that is the worrying part. CERT-EU said the flaws could reach back to PHP 5, launched in 2004. The PHP project no longer supports PHP 8.1 and earlier, but because the flaws are so severe, the security team released minimal source backports for PHP 7.4, 8.0 and 8.1. If you’re on an old version, upgrading to a supported release is the real fix.

What should you do right now?

1. Find out which PHP version you run. Check your hosting dashboard (cPanel, Plesk, etc.) or ask your hosting provider.

2. Update to a patched version. The PHP team says there are no complete mitigations, and updating is the only safe choice. Target 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer release.

3. If you can’t patch immediately, apply temporary hardening. The advisory-based quick fixes include disabling session.upload_progress.enabled, removing the memory limit with memory_limit = -1, and turning off fatal_error_backtraces. These have side effects (for example, upload progress tracking stops working), and they are stopgaps, not replacements for patching.

4. Update your CMS, plugins and themes. If you use WordPress or a similar platform, apply all pending updates too.

5. Scan your servers. Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed.

6. Check your logs. Look for unusual requests or unexpected files. The flaws were publicly disclosed on October 21, so any server left unpatched since then deserves a closer look.

Shared hosting users: don’t wait

If your site is on shared hosting (very common in India), you can’t change the PHP version on the server yourself. Contact your host, confirm they’ve applied the patch, and ask whether your account needs a PHP version switch from the control panel.

The bottom line

PHP2Shell is one of the most serious web-server vulnerabilities in recent memory. The fix exists, so the main risk now is delay. Whether you run a personal blog or a company website, check your PHP version today and patch.

Stay tuned for more updates as the situation develops

Privacy policy

Terms and conditions

As an Amazon Associate, I earn from qualifying purchases