Post cover image

October 24, 2026

PHP2Shell: What Happened to PHP This Week, and What You Need to Do Now

PHP shipped emergency patches for two critical remote code execution flaws. If your site runs on PHP, which about three-quarters of the web…

By Toolifypro

3 min read

PHP shipped emergency patches for two critical remote code execution flaws. If your site runs on PHP, which about three-quarters of the web does, here is what happened and what to do.

What happened

PHP released emergency updates for two critical flaws in the language runtime that let an attacker with no account run code on a web server. Researchers nicknamed the pair PHP2Shell. They are tracked as CVE-2026–109618 and CVE-2026–109619, and both are rated 9.2 on the CVSS v4.0 scale.

The flaws sit in PHP itself, not in any plugin, theme or framework. A site is exposed even when its own code is secure, and even a bare "Hello World" page on a vulnerable version can be attacked.

Who is affected

Every PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The report says mod_php is the highest-risk setup. The researchers also showed that an attacker can read memory from the PHP worker process, which may hold passwords, tokens, API keys and certificates.

The flaws affect nearly every PHP version back to 5.4, and the underlying code had been in PHP for more than a decade.

The timeline

  1. October 20: A post on Hacker News claimed two PHP remote code execution flaws would be disclosed on October 22. PHP posted an advance notice that evening and moved the release up.
  2. October 21: The fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  3. Same day: watchTowr reported "active exploitation attempts" against both flaws, and Cloudflare said attackers were changing their payloads to get around its firewall rules. As of the latest report, no source had confirmed a successful break-in of a specific server.
  4. October 23: PHP disclosed a third RCE issue, CVE-2026–115560. It affects only web applications configured in an unusual way, PHP considers it an unlikely risk, and no out-of-band release is planned. Mitigation is advised instead.

Real-world fallout

Some organizations went offline as a precaution. The HR platform BambooHR took its service offline in the US, Canada and Ireland. In the Netherlands, government sites including DigiD and MijnOverheid went down, though the national cyber-security centre said it had not seen the flaw abused.

A messy disclosure, and an admission

The PHP Foundation said the coordinated disclosure fell apart before the release. The research firm Calif accidentally posted a video of its working proof of concept, and the vendor Chainguard published images containing the patch about six hours before the fix shipped.

The Foundation also admitted a delay. A core developer first spotted signs of the out-of-memory flaw in PHP's 2024 external audit, but no route to code execution was found then. Competing fixes stalled for months, and the Foundation called the delay "a structural failure" of its decision process and resources. It says it has since changed how it makes security decisions and added staff and tooling.

The AI angle

The flaws were found by researchers at Wiz Research, Calif and OpenAI's Codex Security team, who say AI models helped turn the old bugs into working exploits. One researcher did in about a week what would otherwise have taken a team months. The speed from discovery to exploit is the part of this story to watch.

What you should do

Update the PHP runtime, then restart everything. Updating WordPress or Laravel does not update the PHP beneath it. The update comes from your server package, your host or your container image. After updating, restart Apache, PHP-FPM and any long-running PHP workers.

PHP branch First fixed version 8.5 8.5.12 8.4 8.4.27 8.3 8.3.36 8.2 8.2.35

  • On shared hosting: check your host's status page or contact support to confirm they've patched.
  • On PHP 8.1 or older: these versions no longer get updates from the PHP project, though source backports exist for 7.4, 8.0 and 8.1. Plan an upgrade now.
  • If you can't update yet: the advisory says only updating is a complete fix. Disabling session.upload_progress.enabled helps with only one of the flaws, and it was never a full fix.
  • After updating: the fix adds a new hard memory limit, so check your memory_limit and post_max_size values against what your application needs.

Also note that PHP 8.2 reaches end of life on December 31, 2026. This is a good moment to move to 8.4 or 8.5.

The bottom line

PHP isn't going anywhere, and this was a serious but patchable event. The lessons are practical. Know which PHP version your servers run, don't assume app updates cover the runtime, and treat patch days as urgent now that AI is shortening the window between a bug's discovery and its exploitation.

Sources: