If your website runs on PHP, there is an important security update you should not ignore.

On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities collectively known as PHP2Shell. Both vulnerabilities carry a CVSS severity score of 9.2 out of 10 and could allow an unauthenticated attacker to execute code on a vulnerable server.

The official PHP project has urged users to update immediately, warning that no complete workaround replaces installing the security fixes.

Whether you operate a WordPress website, an online store, or a custom-built business platform, here is what you need to know and what you should do next.

What is PHP2Shell?

PHP2Shell refers to two security vulnerabilities in PHP's core runtime, the software responsible for executing PHP code on a server.

The vulnerabilities are tracked as:

  • CVE-2026-109618: A flaw involving memory corruption during out-of-memory error handling.
  • CVE-2026-109619: A flaw involving stale internal state and memory management between requests.

Both vulnerabilities can potentially lead to remote code execution (RCE) without requiring the attacker to log in.

In simple terms, an attacker may be able to send a specially crafted web request that causes a vulnerable server to execute malicious code. Depending on the server's configuration and permissions, this could give the attacker access to sensitive files, application data, and other resources available to the web server.

PHP is widely used across the internet, powering content management systems, e-commerce platforms, business websites, and custom web applications. That broad adoption makes vulnerabilities in the language's core runtime particularly important.

How does PHP2Shell work?

Both vulnerabilities involve how PHP manages memory and handles errors while processing web requests.

CVE-2026-109618: Memory corruption during error handling

When PHP runs out of memory while processing a request, some internal data may be left in an incomplete or inconsistent state. Subsequent cleanup operations can mishandle that data, potentially creating an opportunity for an attacker to execute code.

CVE-2026-109619: Stale internal state

PHP can also mishandle internal state that should have been cleared or reinitialized. Under certain conditions, later operations may access memory that is no longer valid, potentially allowing an attacker to manipulate program execution.

The important distinction is that these are vulnerabilities in PHP itself, not necessarily in a particular website, plugin, or theme.

An attacker does not need to exploit a weak password or compromise an administrator account first. The vulnerable PHP runtime can be the entry point.

The risk is particularly concerning for Apache servers using mod_php, where an attack can potentially trigger before the website's application code runs. However, other PHP deployment configurations are also affected, including PHP-FPM, CGI-based setups, FrankenPHP, and LiteSpeed.

The exact exposure depends on the PHP version, server configuration, and attack path.

What could happen if your website is vulnerable?

Successful remote code execution can have serious consequences, although the actual impact depends on the attacker's privileges and the server's security controls.

Potential consequences include:

  • Data theft: Attackers may access customer information, contact forms, database credentials, or other sensitive data available to the compromised process.
  • Website defacement: Malicious code can alter website content or inject unwanted redirects.
  • Hidden backdoors: Attackers may create mechanisms that allow them to regain access even after the initial vulnerability is patched.
  • Malware distribution: A compromised website could be used to distribute malicious files or redirect visitors to harmful websites.
  • Business disruption: Cleaning an infected server, restoring backups, and investigating a breach can cause downtime and unexpected costs.

For businesses, the damage can extend beyond the technical incident. Customers may lose trust, search engines may flag the website, and regulatory or contractual obligations may apply if personal information is exposed.

Is PHP2Shell being exploited?

The vulnerabilities were publicly disclosed alongside emergency security updates on October 21, 2026. Security vendors and infrastructure providers have since published advisories and mitigation guidance.

As with many critical vulnerabilities, the publication of technical details can encourage attackers to scan for vulnerable servers and develop attack methods. However, the existence of a vulnerability, a demonstrated exploit, and confirmed exploitation in real-world attacks are different things.

Website owners should not wait for evidence that their particular site is being targeted.

A critical vulnerability that allows unauthenticated code execution warrants prompt action, even if there is no confirmed evidence of a successful compromise.

How to protect your website

The PHP development team released patched versions for the following branches:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

These releases address both PHP2Shell vulnerabilities. Older releases within these branches should be upgraded to the corresponding patched version or a later release containing the fixes. See the official PHP releases for details.

Here are the steps website owners should take.

1. Check your PHP version

Determine which PHP version your website uses. Depending on your setup, you may find this information in your hosting control panel, server configuration, or hosting provider's documentation.

If you manage your own server, verify the PHP version used by the actual web application, not just the version available in your command-line terminal.

2. Install the security update

Upgrade to a patched PHP release or install a vendor-provided package that includes the relevant fixes. Restart or reload the necessary PHP workers and services so that the patched runtime is actually running.

If you use shared hosting, contact your hosting provider and ask whether the PHP2Shell fixes have been applied to your environment.

3. Check whether your PHP version is still supported

Older, end-of-life PHP branches may not receive official security updates. You may need to upgrade to a supported branch or use a security patch provided by your operating system or hosting vendor.

Do not assume that a version number alone tells the whole story. Some vendors backport security fixes without adopting the upstream version number.

4. Use a web application firewall

A web application firewall (WAF), such as Cloudflare's WAF or a comparable service, can help block known malicious request patterns.

AWS has also published guidance on using AWS WAF to mitigate PHP2Shell attack paths.

However, a WAF is an additional layer of defence, not a substitute for patching. PHP's official guidance is clear that updating is the only complete fix.

5. Back up your website and test it

Before a planned update, take a fresh backup of your website and database. Apply the patch, then test important functions such as login forms, contact forms, payment processing, and checkout.

For production websites, coordinate the update with your hosting provider or developer to minimise disruption.

6. Investigate suspicious activity

Review server logs and file changes for signs of compromise. Look for unexpected PHP files, unfamiliar administrator accounts, suspicious redirects, or unusual outbound connections.

These signs are not proof of a PHP2Shell attack, but they warrant investigation.

What if your website may already be compromised?

Patching closes the known vulnerability, but it does not automatically remove malicious code that may already be on your server.

If you suspect a breach, preserve relevant logs and investigate before making changes that could destroy evidence. Have a qualified security professional assess the affected environment, identify persistence mechanisms, and determine whether sensitive information was accessed.

Depending on the findings, recovery may require restoring from a verified clean backup, patching PHP, removing unauthorised accounts and backdoors, and rotating exposed credentials and API keys.

Simply deleting a suspicious file is not enough to establish that a website is clean.

The bottom line

PHP2Shell is a reminder that website security depends on more than strong passwords, secure plugins, and a well-designed website. The underlying software must also be kept up to date.

If your website runs PHP, verify your version and confirm that the relevant security fixes have been installed. If you rely on a hosting provider or external developer, ask them to confirm the status rather than assuming the update has been handled.

Not sure whether your website is protected?

Our team helps businesses identify website security gaps, review their technical setup, and understand what needs attention.

Book a Free Digital Audit and we will review your website's PHP version, basic security configuration, and potential areas of concern, then explain our findings and recommended next steps.

No pressure and no obligation.

Book a Free Digital Audit Meet the team behind it

Sources and further reading

Security information checked against available advisories as of October 22, 2026. Patch availability and deployment status may vary by hosting provider and operating system.