Your website might load quickly, take orders, and look brand new. Still, underneath the surface, a security vulnerability could be putting it all at risk.
That’s what PHP2Shell exposed this October. The flaws sit inside PHP, the software running underneath most of the web. They’d gone undetected for more than a decade. After the alert went out on October 21, governments from Japan to Finland took websites offline rather than risk it.
Here’s what the bugs actually do, who’s at risk, and what to do this week. I’ll also share my take as a developer: the bigger lesson here is about maintenance.
What is PHP2Shell?
PHP2Shell is the nickname for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker take over a web server without a password. Both are rated 9.2 out of 10 on the industry’s standard severity scale.
You may never have heard of PHP, but you probably interact with websites built with it every day. It powers WordPress, online shops, and Wikipedia, and W3Techs puts it behind about 7 in 10 websites with a known server-side language.
That’s why this one is different. The flaws aren’t in a plugin or a theme. They’re in the engine every one of those sites runs on.
How the two bugs work
Both bugs come down to PHP trusting memory it shouldn’t. An attacker sends a carefully shaped request, PHP mishandles its own internal data, and that opening becomes remote code execution.
To understand how these vulnerabilities work, it helps to know one thing about PHP. Each visit to your site is a request. A PHP worker process sets up memory for that request, builds the page, cleans up, then moves on to the next visitor. On busy servers, the same worker handles thousands of requests in a row.
CVE-2026-109618: the half-built request
PHP gives each request a memory budget (the memory_limit setting). When a request exceeds it, PHP stops right away, even if it’s in the middle of setting up internal data.
The problem is what happens next. The cleanup code assumes everything it finds is complete and valid. An attacker can send oversized or crafted request data to trip the limit at just the wrong moment, then use that half-built data to corrupt memory and run code.
Think of a builder called away mid-job, and an inspector who signs off on the scaffolding without checking it.
CVE-2026-109619: the leftovers from the last visitor
Some internal data belonging to one request can outlive the memory it points to. When the same worker picks up the next request, it may use that stale data before it’s reset.
In developer terms, it’s a dangling pointer. In plain terms, it’s a restaurant table that wasn’t cleared, and the next guest gets handed the last guest’s tab. An attacker can arrange for that leftover memory to hold something they control.
Why the setup matters
Every common way of running PHP is in scope, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, and FrankenPHP. PHP rates Apache mod_php as the highest risk, because an attacker can succeed before your site’s own code even runs.
That detail matters. On those setups, WordPress security plugins and login protection never get the chance to step in.
Who found them?
Security researchers Calif and Wiz found the flaws in August 2026, with help from AI tools. Ryan Austin of the security firm Calif reported them through OpenAI’s Patch the Planet program, and Wiz Research found the same bugs independently using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Austin told the BBC it was “the most serious vulnerability I’ve ever found.”
The fix was meant to land quietly. Then, details leaked on social media on October 20, and PHP issued its emergency release the next day.
Who’s at risk
If your website runs on PHP and serves visitors, assume it’s at risk until your host or developer confirms it’s patched.
That covers most business sites, online stores and school portals. It also covers what people often forget: an old staging copy, a campaign microsite from years ago, the admin panel on a router or network device.
On an unpatched server, an attacker could:
- access and steal sensitive information like customer data, logins, or business records
- change what your site shows or redirect visitors to malicious pages
- plant a hidden backdoor to let them regain access later
Attackers are already trying. Amazon says attackers started probing four days before the fix was released. Cloudflare CEO Matthew Prince saw hundreds of thousands of exploit attempts within two hours of the announcement, and millions more since then.
By October 24, researchers had demonstrated successful exploitation against three honeypots, or decoy servers designed to attract and monitor attackers. While these findings confirmed that PHP2Shell could be exploited under certain conditions, no successful compromise of a real-world production system had been publicly verified as of October 28.
Why governments took their sites offline
Governments went offline because they couldn’t risk citizen data while they waited to patch.
On October 21, Edinburgh council, the Finnish government, and the Dutch cybersecurity agency pulled sites offline. In the UK, council and Metropolitan Police sites also went dark, and the tech minister told the House of Lords that 32 government services were unavailable. The US National Security Agency told organizations to update, or take systems offline if they couldn’t, warning the flaws could give attackers a “direct path” to a server’s files or database.
Government sites carry extra weight. They hold IDs and addresses, plus tax and health records. Many run on older systems or third-party hosting that’s slow to update.
Going offline was the safe call, but it had a cost. People lost access to public services, and in Japan, carriers SoftBank and NTT Docomo temporarily suspended certain emergency alert services during security maintenance. SoftBank's suspension initially included earthquake and tsunami warnings, while NTT Docomo maintained those alerts but paused other disaster and evacuation notifications while they patched.
What about Philippine government sites?
As of this writing, no Philippine government website has been confirmed to have been breached via PHP2Shell. That’s good news, and it’s also a window to act.
CERT-PH, the national cybersecurity response team under the DICT, flagged the flaws on October 22. It urged government and private organizations to patch as soon as possible.
Elsewhere in the region, Singapore’s Cyber Security Agency has reported widespread attempts to exploit PHP2Shell.
Attackers don't sort targets by country. Their automated tools scan every PHP server they can reach, .gov.ph portals included. Sites still on older PHP versions, or on hosting that's slow to update, are the ones most likely to get caught out.
For any agency or contractor running a .gov.ph site, now is the time to check the PHP version and patch.
What to do now
Step by step
Update PHP to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP’s own team says updating is the only full fix.
4 steps
Find out what you’re running.
Ask your host, or check your hosting panel for the PHP version.
Update PHP itself.
Updating WordPress or its plugins doesn’t touch PHP.
Restart PHP.
Workers keep running old code until they restart, so the fix doesn’t load until you do.
Confirm it.
After the restart, check the version your site is actually serving.
If someone else hosts your site, one message covers it:
“Is our PHP patched for PHP2Shell, and have you confirmed the fixed version is running?”
If you can’t update right away
Restrict who can reach the server, or take the site offline for a short while. PHP’s official advisory also lists temporary settings that lower the risk, though they don’t remove it. One of them, turning off session upload progress, also covers a narrower flaw PHP flagged on October 23 (CVE-2026-115560) that has no fix yet.
On PHP 8.1 or older, there’s no standard update. Ask your host about vendor patches, or plan a move to a supported version.
My take: PHP isn’t dead, but old PHP is a liability
“A website isn’t finished when it launches. That’s the day its maintenance starts.”
As a developer, I put security above everything else on a project. A fast, beautiful site means very little if a stranger can walk into its server. PHP2Shell didn’t change my mind on that. It just made the case louder than I ever could.
“PHP is dead” didn’t age well
For years, people have joked that PHP is dead. Yet a dead language doesn’t send governments scrambling to switch off their websites.
PHP still runs most of the web, and the modern PHP 8 line is fast and well supported. The weak spot was never the language. It’s the sites left on old versions that nobody has looked at since launch.
Launch day isn’t the finish line
Every website sits on layers: the server, PHP, the CMS, the theme, the plugins. Each layer ages at its own pace.
Most owners keep the top layers fresh because they can see them. A new plugin version shows up right in the dashboard. PHP doesn’t send you a reminder. That’s exactly why it gets left behind, and why PHP2Shell hit as hard as it did.
If government agencies with full IT teams had to go offline, a small business site isn’t too small to be a target. Attackers scan the whole internet at once. They don’t pick sites by size; they pick them by version.
Maintenance is a shared job
No single person can keep a site secure alone. Here’s what I’d ask of each side:
- Developers: Track the end-of-support date of every PHP version you run, test on the next version early, and tell clients about updates before they have to ask.
- Hosts and server admins: Patch quickly, confirm the fix is running, and give every old PHP version a migration plan with a date.
- Business owners: Budget for maintenance the way you budget for hosting. And if you look after the site yourself, put PHP updates on the same calendar as your plugin updates.
AI means PHP2Shell is only the beginning
For me, the scariest part of PHP2Shell isn’t the bug. It’s how it was found.
These flaws hid in PHP for more than a decade. AI tools helped find them. As UNSW Sydney researcher Salil Kanhere told the BBC, “The underlying bugs weren’t new; what changed was our ability to find them.”
AI is improving fast, and attackers have access to the same tools as defenders. I expect more discoveries like this, in PHP and in the other software our websites run on. Code that seemed safe for years will keep getting a closer, faster look.
That’s why I see PHP2Shell as the start of a trend, not a one-off. The sites that make it through the next one in good shape will already be on a regular maintenance routine.
There’s a practical date to plan around too. PHP 8.2 stops getting security fixes on December 31, 2026. If your site is on 8.2, start the upgrade conversation now with your developer or host.
So here’s what I’d leave every client with:. Fast patching used to be good practice; with AI in the picture, it’s the baseline. Make website maintenance a monthly habit, and the next PHP2Shell update becomes routine instead of an emergency.
Final thoughts
PHP2Shell is serious, but it’s fixable. The patched versions are out, and for most sites the update itself is routine.
The bigger story is what it revealed. Many websites look fresh on the surface while the software underneath is years behind.
Governments showed what happens when that gap meets a critical bug: the only safe move left is to switch off. You can stay out of that position with a few routine checks.
Start with one question to your developer or host this week. Then make PHP part of your website’s monthly upkeep, so the next alert finds you ready.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a web server without logging in.
Is my WordPress site affected?
Probably, if it runs on an unpatched version of PHP. Ask your host which PHP version your site uses and whether it has the October 21 fix.
Does updating WordPress fix PHP2Shell?
No. WordPress and its plugins run on PHP. The fix has to be applied to PHP on the server.
Why did government websites go offline?
To protect citizen data while they patched. Security agencies, including the UK’s NCSC, advised taking systems offline if they couldn’t quickly update or apply PHP’s temporary safeguards.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older don’t get official updates, so plan a move to a supported version.
How often should I update PHP?
Apply security updates as soon as they’re released, and plan a version upgrade before your current one reaches end of support. A monthly check can keep it from becoming an emergency.
