PHP2Shell: Critical PHP Flaws Put Unpatched Websites at Risk

Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, were fixed on 21 October 2026. Security teams have reported active exploitation, so any website running an unpatched PHP version should be updated now.

Facts checked on 31 October 2026. Details can change as vendors publish more information, so confirm against the sources at the end.

What is PHP2Shell?

PHP2Shell is the name used for a pair of serious vulnerabilities in the PHP engine itself, not in one plugin or framework. Because the flaws sit in PHP, every site built on it can be affected, whether it runs WordPress, Laravel, Drupal, Magento or custom code.

We are deliberately not describing how the flaws work. What matters for site owners is simple: attackers are trying them, and the fix is a PHP update.

Who is affected?

Any server running a PHP version older than the fixed releases:

If your hosting company or Linux distribution ships its own PHP packages, the version number may look old even though a fix has been backported. Ask them to confirm in writing.

How it unfolded

• 17 October: Amazon reported an exploitation attempt, days before the public announcement.
• 20 October: The PHP project announced an out-of-band release. Technical details started to leak.
• 21 October: Fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released, with active exploitation reported.

What to do today

1. Find the PHP version your website actually uses

The version on the command line is not always the one your website uses. Check the one the web server runs: a phpinfo() page you remove afterwards, your hosting control panel, or your host's support team.

2. Update, or ask your host to

Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). On shared hosting this is usually a setting in the control panel. On a managed host, open a ticket. If you run an older branch, ask for a vendor backport or plan an upgrade to a supported version.

3. Can't update yet? Reduce exposure

Some settings can reduce the attack surface, for example disabling risky functions in php.ini. These are partial measures, not a fix. Treat them as a short bridge to the update and nothing more.

4. Look for signs of an attack

Check your logs for unusual memory or crash errors from PHP, and for shell processes started by your web server's user. If you do not know what to look for, ask your developer or host to review.

5. If in doubt, rotate secrets

If you suspect a compromise, change passwords, API keys, database credentials and tokens that the server could read, and review recently changed files.

Special cases

• WordPress, Drupal and Joomla: the CMS does not protect you here. The fix is at the PHP level, so update PHP itself.
• Shared hosting: you cannot patch the server, but you can ask your host which PHP builds are fixed and switch your site to one.
• Containers: rebuild your image from a fixed PHP base image and redeploy. Updating the running container's code is not enough.
• End-of-life branches: PHP 8.1 and older have no official fix. PHP 8.2 stops receiving security fixes on 31 December 2026, so plan the next upgrade now.

Why a secure application is not enough

You can write careful code, validate every input and keep plugins updated, and still be exposed if the PHP engine underneath has a flaw. Keeping the runtime, the operating system and the application patched are three separate jobs, and the runtime is the one that is easiest to forget.

How Develenza can help

If you would rather not do this alone, we can check which PHP version your sites run, apply the update, review logs for signs of abuse and set up a routine so the next patch does not catch you by surprise. Contact us and we will take a look.

Sources

• PHP project announcements and changelogs: php.net archive 2026 and PHP 8 changelog
• Datadog Security Labs: PHP2Shell critical vulnerabilities in PHP
• Recorded Future: PHP2Shell vulnerability exploitation
• PHP2Shell on Wikipedia