PHP2Shell is two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. An attacker can execute code on the server with a single request, without authentication, before your application runs. Every PHP installation that serves web pages is affected. The fix is updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Not sure which PHP servers you expose to the internet? Our external prospecting report shows the web services visible from outside. It is free and we run it only with your consent.
Request the free reportWhat PHP2Shell is
PHP2Shell is the name given to the two vulnerabilities. The first relates to how PHP handles running out of memory. The second, to data left over from an earlier request in the same process. Both lead to the same result: remote code execution, without an account or a password.
The flaws had existed for decades. Wiz researchers say frontier AI models greatly reduced the effort needed to turn an old flaw into a working attack.
How serious it is
- PHP runs behind 75–80% of websites, including WordPress, Joomla and Drupal.
- VirusTotal estimates more than 5.1 million PHP servers exposed to the internet.
- Qualys saw 167 million PHP installations. 71% run versions that no longer receive updates, and only 199,000 were updated in the first 12 hours.
- Amazon recorded an attack attempt on 17 October, and Cloudflare observed early attacks before the fixes were released.
- PHP also runs inside appliances. On 21 October, Palo Alto confirmed that PAN-OS and Panorama are affected.
The UK National Cyber Security Centre, NCSC, recommends taking offline any system that cannot be updated quickly.
What to do in the first 24 hours
1. Find where PHP runs
Make the full list: the corporate site, the online shop, the customer portal, the intranet, internal applications, appliances with a web interface such as firewalls, NAS devices or routers, and services hosted by providers. Start with everything reachable from the internet.
Check the version used by the web server, from the hosting panel or the package manager. The php -v command may show a different installation from the one serving the site.
2. Update
| PHP branch | Fixed version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1, 8.0, 7.4 | no regular update; source-code fixes only |
| 7.3 and older | no fix; migrate |
Linux distributions may fix the package without changing the version number. Check your distribution’s advisory, not just the number shown.
3. Ask your providers for confirmation
If your site is with a hosting provider, ask today for written confirmation that PHP has been updated on your servers. The same for SaaS applications and appliance vendors: follow their advisories and apply updates as soon as they appear.
4. If you cannot update today
- restrict public access to the server or take it offline temporarily;
- put the server behind a web application firewall. Cloudflare has published rules for PHP2Shell, available on free plans too;
- apply the temporary measures from the official PHP advisory, for example
session.upload_progress.enabled = Offand, in PHP-FPM,pm.max_requests = 1, with the corresponding performance cost.
Temporary measures reduce the risk, but they do not make an unpatched server safe. Updating remains mandatory.
5. Check whether you were already attacked
Attacks started before the announcement, so check the logs from 17 October onwards:
- new or modified PHP files in the site directories;
- new administrator accounts in applications or in the system;
- new scheduled tasks and unknown processes;
- unusual outbound connections from the server;
- many memory errors in the PHP logs within a short interval.
If you find something, isolate the server, keep the logs and get help from an incident response team before deleting anything.
6. Test from the outside
After updating, check from the internet which web services are still exposed and which versions they report. A forgotten server from an old project is usually the one left unpatched.
If you are a NIS2 entity
Vulnerability handling is a mandatory measure under OUG 155/2024, art. 13 (e). If PHP2Shell leads to a significant incident, the early warning to DNSC is due within 24 hours. Keep the evidence: the server list, the update date, the results of the checks. You will use them in the self-assessment and at the audit. The details are in the NIS2 documentation guide and the one on NIS2 fines.
How TRU helps
Through monthly external PenTest we check your exposed services and vulnerable versions from the internet, and the report shows what to remediate, in order of priority. Internal PenTest does the same inside the company network, where forgotten servers usually sit. Prices start at €31 per IP per month, and the external prospecting report is free.
Sources
CISA · NCSC · Qualys · Help Net Security · BleepingComputer · Wiz. The situation is evolving: also check your vendor’s or distribution’s advisory.