Two critical vulnerabilities in PHP have triggered emergency security updates and warnings from cybersecurity agencies worldwide. The flaws, known as PHP2Shell, could allow attackers to execute malicious code on vulnerable servers without authentication.
PHP powers millions of websites, web applications, and content management systems. It is widely used by WordPress, Drupal, Joomla, and many custom applications.
On October 21, 2026, the PHP development team released emergency security updates after two critical vulnerabilities were identified in the PHP runtime.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both received a critical severity rating of 9.2 under CVSS 4.0.
The situation quickly attracted attention from government cybersecurity agencies, hosting providers, cloud companies, and security researchers.
But how did this happen? When did the problem start? What exactly can attackers do? And what should website owners do now?
Here is the complete story, from the first public warning to the latest developments.
What Is PHP2Shell?
PHP2Shell is the name used for two critical security vulnerabilities affecting the PHP programming language.
The vulnerabilities involve problems in how PHP handles memory and internal request data.
Under certain conditions, an attacker can trigger these weaknesses through specially crafted requests.
Successful exploitation could allow an attacker to execute arbitrary code on a vulnerable server without first logging in.
This is known as unauthenticated remote code execution, or RCE.
Remote code execution is one of the most serious types of software vulnerability because it can give attackers the ability to run commands on a system from another location.
Depending on the server configuration and the permissions available to the PHP process, an attacker could potentially:
- Execute malicious code.
- Access sensitive application data.
- Read information stored in process memory.
- Steal credentials or authentication tokens.
- Modify application files.
- Use a compromised server as a starting point for further attacks.
However, these outcomes depend on the affected system and the privileges available to the attacker.
The vulnerabilities do not automatically mean every PHP website has been compromised.
The important point is that vulnerable PHP installations may be exposed to serious attacks, and updating is the recommended way to address the problem.
When Did the PHP Security Problem Start?
The public timeline began before the emergency patches were released.
October 20, 2026: PHP Announces an Upcoming Security Release
On October 20, the PHP project announced that an important security release was coming.
The announcement indicated that the project was preparing fixes for critical vulnerabilities.
This gave developers and security teams an early warning that a security update would soon be required.
However, the full technical details were not initially available.
Security releases are often coordinated in this way because publishing technical details before fixes are ready can give attackers an opportunity to exploit vulnerable systems.
The PHP project prepared updates for multiple supported release branches.
October 21, 2026: Emergency Security Updates Released
On October 21, the PHP development team published the security updates.
The release announcements confirmed that the vulnerabilities could allow unauthenticated remote code execution.
The project strongly encouraged affected users to upgrade.
It also warned that there were no complete mitigations that could replace the security updates.
The announcement marked the beginning of the public response.
Security researchers, hosting providers, cloud platforms, and government cybersecurity agencies began publishing their own advisories.
Official announcement: PHP 8.5.12 Released
October 21, 2026: European Cybersecurity Agencies Issue a Joint Warning
The European Commission, ENISA, CERT-EU, Europol EC3, and national cybersecurity response teams published a joint statement.
They advised organizations to take immediate action.
Their warning focused on identifying affected PHP applications, coordinating with hosting providers, and applying security updates.
The agencies specifically recommended prioritizing internet-facing systems.
These systems are especially important because they can receive requests directly from the public internet.
The joint statement showed that the vulnerability was being treated as a serious international cybersecurity issue.
Source: ENISA joint statement on critical PHP vulnerabilities
October 21–22, 2026: Technical Details and Exploit Research Become Public
After the security updates were released, technical information about the vulnerabilities became more widely available.
Security researchers began discussing how the flaws worked.
Proof-of-concept research also started circulating.
A proof of concept demonstrates how a vulnerability may be triggered. It does not necessarily mean that every affected system can be successfully exploited using the same method.
Nevertheless, public exploit research can make it easier for attackers to understand and reproduce a vulnerability.
CERT-EU warned that the availability of technical details and proof-of-concept research increased the likelihood of exploitation.
The Canadian Centre for Cyber Security also described the vulnerabilities as PHP2Shell and advised organizations to patch affected systems immediately.
Sources: CERT-EU advisory · Canadian Centre for Cyber Security
What Are the Two PHP Vulnerabilities?
The security problem consists of two separate vulnerabilities.
Both affect PHP’s internal handling of memory and request data.
CVE-2026-109618: Out-of-Memory Handling Vulnerability
The first vulnerability involves how PHP handles an out-of-memory condition.
An out-of-memory condition occurs when a program cannot allocate the memory it needs to continue processing.
In this situation, PHP may interrupt an operation while internal request data is only partially initialized.
The problem occurs when PHP subsequently attempts to clean up that incomplete data.
Under certain conditions, the cleanup process can treat invalid internal data as if it were valid.
This can cause memory corruption.
Researchers found that the problem could potentially be exploited to achieve remote code execution.
The vulnerability is especially concerning because an attacker may be able to trigger the condition through a specially crafted request.
The exact impact depends on the PHP version and execution environment.
CVE-2026-109619: Stale Request State and Memory Use-After-Free
The second vulnerability involves stale internal state.
PHP applications often process multiple requests using the same worker process.
When a request finishes, the application must clean up the data associated with that request.
The vulnerability occurs when internal references remain after the memory they point to has already been freed.
A later request handled by the same worker may then encounter those stale references.
This is known as a use-after-free vulnerability.
If the application accesses memory after it has been freed, the resulting behavior may be unpredictable.
Researchers demonstrated that this issue could potentially lead to remote code execution.
It may also expose sensitive information stored in process memory.
This is particularly important for applications that handle authentication tokens, passwords, API keys, and other confidential information.
Both vulnerabilities received a CVSS 4.0 score of 9.2, indicating critical severity.
Source: Google Cloud’s technical explanation of PHP2Shell
Which PHP Versions Are Affected?
The vulnerabilities affect a broad range of PHP versions.
According to the security information published by PHP and cybersecurity agencies, vulnerable versions include PHP releases before the following patched versions:
| PHP branch | Security update |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP versions 8.1 and older are also affected, but those branches have reached end of life and do not receive the same official security updates.
This creates an additional challenge for organizations that continue to operate older PHP applications.
They may need to migrate to a supported version or obtain appropriate extended security support.
The vulnerability is not limited to a particular website framework.
It affects the PHP runtime itself, which means applications using vulnerable PHP installations may be exposed.
Source: Official PHP security release information
Why WordPress, Drupal, and Joomla Users Should Pay Attention
PHP is a major part of the web application ecosystem.
WordPress uses PHP to process website requests, load plugins, interact with databases, and generate pages.
Drupal and Joomla also rely on PHP.
That means the security of these applications depends partly on the PHP runtime installed on their servers.
The NHS England National Cyber Security Operations Centre reported that successful exploitation of the vulnerabilities had been demonstrated in products integrating PHP, including WordPress, Drupal, and Joomla.
This does not mean every WordPress website is automatically vulnerable.
The important distinction is between the application and the runtime.
A website may have updated WordPress core and plugins but still use an outdated PHP installation.
In that situation, updating WordPress alone may not resolve the underlying PHP vulnerability.
Website owners should check their hosting environment and confirm which PHP version is actually running.
Source: NHS England Digital security alert
How Could Attackers Exploit PHP2Shell?
The vulnerabilities create several possible attack scenarios.
Scenario 1: Attacking an Internet-Facing PHP Server
An attacker identifies a server running a vulnerable PHP version.
The attacker then sends a specially crafted request designed to trigger the vulnerable memory-handling behavior.
If the exploit succeeds, the attacker may gain the ability to execute code with the privileges of the PHP process.
This could provide access to application files, configuration data, or connected services.
Scenario 2: Accessing Sensitive Application Information
PHP applications frequently interact with databases and external services.
Their configuration files may contain credentials, API keys, or database connection details.
If an attacker gains code execution, those credentials may become accessible.
The attacker could then attempt to access other systems using the compromised credentials.
However, the extent of this risk depends on how the application is configured and how its credentials are protected.
Scenario 3: Compromising a Shared Hosting Environment
Shared hosting environments may run multiple websites on the same physical server.
The security impact depends on whether each website is properly isolated.
If an attacker compromises one PHP application, the attacker may attempt to access resources belonging to other applications.
Strong account isolation and restricted permissions can reduce this risk.
This is one reason hosting providers need to update their PHP packages and review the security of their server environments.
Did Attackers Already Exploit the Vulnerabilities?
This is one of the most important questions.
The security agencies have warned about exploitation risks and the availability of proof-of-concept research.
The National Computer Emergency Response Team of the Philippines reported that Cloudflare had observed early exploitation attempts around the disclosure period.
CERT-EU also warned that public technical information and proof-of-concept research increased the likelihood of exploitation.
However, these reports should not be interpreted as proof that every vulnerable PHP server has been attacked.
They also do not establish that every reported attempt successfully compromised a system.
At the time of the cited advisories, the public information did not establish a confirmed PHP2Shell compromise of a specific Philippine organization.
Organizations should therefore distinguish between:
- Vulnerabilities that have been confirmed.
- Exploitation attempts that have been reported.
- Successful compromises that have been independently verified.
This distinction matters because cybersecurity reporting can sometimes confuse the existence of an exploit with evidence of a successful attack.
The safest approach is to patch immediately and investigate suspicious activity rather than assume that a server is either safe or already compromised.
Sources: CERT-PH advisory · CERT-EU advisory
How PHP Developers and Website Owners Should Respond
The PHP development team has stated that updating is the recommended solution.
Organizations should begin by identifying every system running PHP.
This includes production websites, development environments, internal applications, and services managed by external hosting providers.
1. Check Your PHP Version
Developers can check the PHP version installed on their systems using:
php -vFor a web application, the command-line PHP version may differ from the version used by the web server.
Therefore, website owners should also verify the PHP version configured in their hosting control panel or server environment.
2. Install the Appropriate Security Update
Organizations should install the patched PHP version appropriate for their release branch.
The official PHP security announcements provide the release information and downloads.
For hosting environments, updates may be delivered through the hosting provider or package manager.
After installation, verify that the web server is using the patched runtime.
3. Update Hosting Control Panels and PHP Packages
Hosting providers also need to update their PHP packages.
cPanel published its own security guidance and updates for affected PHP packages.
Administrators should check their hosting control panel’s security notices and confirm that the relevant PHP packages have been updated.
Source: cPanel PHP security release guidance
4. Review Server Logs
After applying the updates, administrators should review server logs for suspicious activity.
They should look for unusual requests, unexpected PHP errors, abnormal process behavior, and suspicious file changes.
If there is evidence of compromise, patching alone may not be sufficient.
The organization may need to investigate the incident, rotate exposed credentials, restore affected files, and review connected systems.
5. Protect Older PHP Applications
Some organizations still use PHP versions that no longer receive official security updates.
These systems require additional attention.
Where possible, administrators should migrate to supported PHP versions.
If migration cannot happen immediately, organizations should consider extended security support and reduce exposure through network restrictions, application isolation, and other defensive controls.
These measures can reduce risk, but they should not be treated as a replacement for an available security fix.
What Happened After the Emergency Release?
The response continued beyond the PHP development team’s initial announcement.
Cybersecurity agencies published additional guidance.
Hosting providers began updating their supported PHP packages.
Researchers shared technical information about the vulnerabilities.
Cloud providers also explained how their customers could identify and protect affected applications.
Google Cloud published a technical analysis describing the vulnerabilities and confirmed that its own cloud infrastructure was not vulnerable to the issue.
However, customers running PHP on Google Cloud could still be affected.
This distinction is important.
A cloud provider’s infrastructure may be secure while applications deployed by its customers remain vulnerable.
The same principle applies to other hosting providers.
Organizations must verify the security of their own application environments instead of assuming that cloud hosting automatically protects them from software vulnerabilities.
Google’s Gemini AI Helped Researchers Investigate PHP2Shell
Another important development involved artificial intelligence.
Google Cloud published a report explaining how researchers used AI models to help identify and investigate the PHP vulnerabilities.
The report said that Gemini 4 Argon contributed to vulnerability discovery, exploit development, attack detection, and patch validation.
This is an important example of AI being used in cybersecurity research.
AI models can help researchers analyze complex code, identify unusual behavior, and explore possible vulnerability paths.
However, the same capabilities can also create concerns about how quickly attackers may develop or adapt exploits.
The PHP2Shell incident therefore highlights both sides of AI-assisted security research.
AI can help defenders discover and fix vulnerabilities.
At the same time, organizations must prepare for attackers to use increasingly capable tools to investigate vulnerable software.
Source: Google Cloud: Responding to core PHP vulnerabilities
What Happens Next?
The next phase of the PHP2Shell story will depend on how quickly organizations update their systems and whether additional exploitation activity is confirmed.
Several developments deserve attention.
More Organizations Will Need to Identify Vulnerable Systems
Large organizations often operate many applications across different servers.
Some applications may use older PHP versions that are not immediately visible to central IT teams.
Security teams will need to identify those systems and verify that they have been patched.
Hosting Providers Will Continue Updating Their Environments
Hosting providers are responsible for maintaining the security of the PHP packages they distribute.
Customers should check their provider’s security notices and confirm that the relevant updates have been installed.
Researchers May Publish More Technical Details
As researchers continue analyzing the vulnerabilities, additional information may become available.
This could help developers understand the underlying issues.
It could also make it easier for attackers to reproduce the vulnerabilities.
Organizations should monitor official PHP security announcements and trusted cybersecurity advisories.
Older PHP Applications Will Remain a Challenge
The vulnerabilities affect older PHP branches that have reached end of life.
Organizations using those versions may face additional migration costs and operational challenges.
The incident reinforces the importance of maintaining supported software and planning upgrades before security problems appear.
Final Verdict: PHP2Shell Is a Serious Warning for the Web
PHP2Shell demonstrates how a vulnerability in a widely used programming language can affect a large part of the internet.
The incident began with an upcoming security release announcement on October 20.
On October 21, PHP released emergency updates for two critical vulnerabilities.
The vulnerabilities could allow unauthenticated remote code execution and potentially expose sensitive memory.
Cybersecurity agencies responded with warnings.
Researchers began publishing technical information.
Hosting providers and developers were urged to update their systems.
The immediate priority is clear: identify vulnerable PHP installations, apply the appropriate security updates, and investigate suspicious activity.
For website owners, the lesson is equally important.
Keeping WordPress, plugins, and themes updated is not enough if the underlying PHP runtime remains vulnerable.
PHP2Shell is a reminder that server security depends on every layer of the application stack.
The PHP security updates are available, and organizations should not delay applying them.
The next major development will be whether widespread patching prevents further exploitation or whether additional confirmed incidents emerge.
For now, PHP developers, hosting providers, and website owners should treat the vulnerability as a critical security priority.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name associated with two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can potentially allow unauthenticated remote code execution.
When were the PHP2Shell vulnerabilities disclosed?
The PHP project announced an upcoming security release on October 20, 2026. The emergency security updates were released on October 21, 2026.
Which PHP versions are affected?
The vulnerabilities affect PHP versions before 8.5.12, 8.4.27, 8.3.36, and 8.2.35, as well as older end-of-life branches.
Is WordPress affected?
WordPress applications running vulnerable PHP versions may be exposed. The issue affects the PHP runtime, not simply WordPress core or its plugins.
Have hackers already exploited PHP2Shell?
Security agencies have reported exploitation attempts and public proof-of-concept research. Those reports do not establish that every vulnerable system has been compromised.
What should website owners do?
Check the PHP version used by the web server, install the appropriate security update, verify the runtime, and review logs for suspicious activity.
Is PHP still safe to use?
PHP remains widely used and supported. This incident highlights the importance of maintaining supported versions, applying security updates, and protecting application environments.
Publishing note: The timeline and technical details above are based on advisories available through October 23, 2026. Keep the article updated if PHP releases additional fixes or security agencies confirm new exploitation incidents.
By
