PHP2Shell — Critical PHP Flaws Let Attackers Take Over Web Servers (2026)

What Is This Threat?

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP language itself, nicknamed PHP2Shell:

CVE-2026-109618 — a memory-handling bug triggered when the server runs out of memory while reading a form submission

CVE-2026-109619 — a "use-after-free" bug where one request can reuse leftover memory from a previous, crashed request

Both are rated 9.2 out of 10 (Critical). Together they allow unauthenticated remote code execution: an attacker who can send a web request to a vulnerable server may be able to run their own commands on it — no password, no account, and no help from the website's own code required.

PHP powers a large share of the web, including WordPress, Drupal, Joomla, Magento, Laravel apps, and countless shop systems and customer portals. Palo Alto Networks counted more than 22 million internet-facing PHP instances that are potentially exposed.

Timeline

| Date | Event |

|---|---|

| October 17, 2026 | Amazon's honeypots record a first exploitation attempt — four days before the flaws were public |

| October 21, 2026 | PHP publishes the advisory and releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |

| October 21, 2026 | Mass internet scanning begins within an hour; at least one European government takes its website offline as a precaution |

| October 22, 2026 | Cloudflare reports exploit attempts rising into the millions |

| October 23, 2026 | PHP warns of a related, lower-risk issue (CVE-2026-115560) affecting unusual session configurations; a fix will follow in the next regular release |

Who Is Affected?

Any PHP installation that answers web requests is in scope — whether it runs as Apache mod_php (the highest-risk setup), PHP-FPM, php-cgi, LiteSpeed, or FrankenPHP, including Docker containers that bundle their own PHP.

| PHP version | Status |

|---|---|

| 8.5 before 8.5.12 | Vulnerable — update to 8.5.12 |

| 8.4 before 8.4.27 | Vulnerable — update to 8.4.27 |

| 8.3 before 8.3.36 | Vulnerable — update to 8.3.36 |

| 8.2 before 8.2.35 | Vulnerable — update to 8.2.35 |

| 7.4, 8.0, 8.1 (end of life) | Vulnerable — no official release; only distribution packages or source backports |

| 7.3 and older | Vulnerable — no fix; upgrade required |

Linux distributions received the patches in advance, so updated packages are available through normal system updates. Some vendors backport fixes without changing the version number — check your distribution's advisory.

How Attackers Use It

Scanning: bots probe millions of websites for PHP servers

Crafted request: the attacker sends an oversized form submission (field names of several megabytes, sometimes with hidden binary data) designed to push PHP into an out-of-memory or fatal-error state

Taking control: if the memory corruption works, the server runs the attacker's command

Payload: security firms Sophos and Arctic Wolf observed attempts to install a variant of the Mirai botnet; other attackers typically plant web shells, crypto miners, or steal databases

Researchers note that building a reliable exploit is harder than first expected, and many attempts fail — but with millions of tries per day, unpatched servers will eventually be hit.

Why It Matters — Even If You Don't Run a Server

If you have a personal blog, small business website, or online shop on shared hosting, it almost certainly runs PHP. Hijacked websites are used to:

Steal customer data, including names, addresses, and payment details entered in checkout forms

Redirect visitors to phishing pages or fake "virus detected" scam sites

Host malware downloads under a trusted domain name

Send spam that damages the domain's reputation

As a visitor, you can't patch someone else's server — but you can watch for signs that a familiar website has been tampered with.

Red Flags Checklist

For website owners:

❌ Log entries showing memory exhaustion errors that reference "Unknown on line 0"

❌ Unusually large POST requests, or worker crashes and segmentation faults in web server logs

❌ PHP or web server processes starting shells (sh, bash) or unknown programs

❌ New, unfamiliar PHP files in upload or cache folders

❌ Unexpected new admin accounts in your CMS

For website visitors:

❌ A familiar site suddenly redirects you somewhere else

❌ Pop-ups claiming your device is infected or asking you to "update" your browser

❌ A checkout page that looks different or asks for more details than usual