PHP2Shell: The Bug That Hid in 70% of Websites for Over a Decade

A critical security flaw hid inside PHP — the programming language behind roughly 70% of all websites — for more than ten years. When it finally came to light in October 2026, hackers were already attacking it. Security researchers are calling it PHP2Shell, and it is one of the most serious internet vulnerabilities in recent years.

Here is what happened, why it matters, and what you should do about it.

What Is PHP2Shell?

PHP2Shell is the name given to two critical flaws in the core engine of PHP itself: CVE-2026–109618 and CVE-2026–109619. Both carry a severity score of 9.2 out of 10 (CVSS 9.2), and both allow unauthenticated remote code execution (RCE). In plain language: an attacker can run their own code on a vulnerable server without needing a username, a password, or any login at all.

What makes PHP2Shell especially dangerous is where the bug lives. It is not a flaw in WordPress, or in any single website or app. It is a flaw in the PHP language runtime itself — the foundation underneath all of them. That means even a bare-bones "Hello World" PHP application is exposed. Every PHP version going back to version 5.4, released in 2012, is affected.

How Was It Found? By AI

Humans missed this bug for over a decade. AI found it.

Researchers at Wiz Research used AI models — including Gemini 4 Argon, GPT-5.6 Sol, and their own Wiz Atlas system — to spot what ten years of human security audits had overlooked. The flaws were also independently reported by Calif, part of OpenAI's "Patch the Planet" effort, and by OpenAI itself.

It is a turning point for cybersecurity: the same AI tools that write code are now finding the flaws hidden inside it. Defenders welcomed the discovery. Attackers, unfortunately, were watching too.

The Timeline: Attacks Started Before the Patch

The sequence of events shows why PHP2Shell became an emergency:

• October 17, 2026 — Attackers began probing for the flaw, four days before any patch existed. Honeypots run by Amazon recorded the first exploitation attempts.
• October 20 — Details of the vulnerability leaked online, ahead of the planned coordinated disclosure.
• October 21 — PHP released emergency patches a day early, under active pressure.
• October 23 — Internet scans by Censys found 34.4 million PHP services still running vulnerable versions. A related flaw the patch does not fix, CVE-2026–115560, was also disclosed.
• October 24 — Reports emerged of state-linked hackers planning PHP2Shell attacks. Singapore-based firm CYFIRMA detected Korean-speaking actors discussing attacks on the I2P network, naming Korean government agencies and financial institutions as early targets. Attribution reliability is rated "moderate" — these are reports, not confirmed facts.

Cloudflare, which protects a large share of the internet's traffic, watched exploitation attempts jump from thousands to millions within hours of disclosure.

The Scale of the Damage

PHP powers about 70% of websites, including WordPress sites, Wikipedia, blogs, online shops, and government portals. When a flaw hits the language itself, the blast radius is enormous.

Governments around the world took drastic action, pulling websites offline rather than risking compromise: the Netherlands took DigiD, MijnOverheid, the Port of Rotterdam, and hospital systems offline; France shut prefecture sites; Germany's federal IT provider ITZBund, Belgium, Finland, Denmark, and UK councils including Oxford, Bristol, and Edinburgh all took systems down. South Africa's Presidency website went offline on October 23. In Pakistan, the National CERT began auditing 300 government websites.

Am I Affected?

If you run any website, application, or server that uses PHP, assume the answer is yes until you check. To find your PHP version:

• On a server, run php -v in the terminal.
• In WordPress, go to Tools → Site Health → Info → Server.

Any version below the patched releases is vulnerable, including versions long out of support.

How to Protect Yourself

1. Update PHP immediately to one of the patched versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
2. If you run PHP 8.1 or older, there is no official patched release. Security guidance in that case is blunt: take the system offline or upgrade to a supported version.
3. Turn off session upload progress. The patch does not fix the related flaw CVE-2026–115560, which abuses PHP's session upload progress feature. Set session.upload_progress.enabled=0 in your PHP configuration until the next release.
4. Use a web application firewall (WAF) with rules blocking PHP2Shell exploitation patterns, especially if you cannot patch immediately.
5. Know your setup. Servers running PHP as an Apache module (mod_php) are at the highest risk. No complete exploit has yet been demonstrated against PHP-FPM setups, but that is not a reason to delay patching.

The Bigger Lesson

PHP2Shell teaches three lessons the whole industry is now absorbing. First, the code we trust most — the foundations, not the apps — can hide flaws for a decade. Second, AI has changed vulnerability research forever: attackers and defenders alike now have tireless bug-hunters. Third, patching speed is everything. The gap between disclosure and mass exploitation is now measured in hours, not weeks.

The vulnerability was not a failure of one company or one team. It was a reminder that the internet runs on shared foundations, and when one cracks, everyone feels it.

Final Word

If you run a website, check your PHP version today and patch it. If you manage servers for others, audit them now. PHP2Shell will be exploited for months — vulnerable systems are already being scanned — and the only safe side of this story is the patched one.

— -

Educational content only. This article is written to help defenders understand and fix a public vulnerability. Never attack systems you do not own — unauthorized hacking is illegal.