PHP2Shell: The Critical PHP Flaw Hackers Are Exploiting Right Now (and How to Patch It) 

Check Your PHP Version Today 

Do you have a website running on PHP? Stop and check your PHP version right now, not next week. Two flaws buried in PHP’s core, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), would let an anonymous attacker run commands on your server without any login. Both score 9.2 out of 10, which puts them firmly in critical territory.

PHP2Shell shipped the fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you’re sitting on anything older in those four branches, you’re exposed. And if your site still runs PHP 8.1 or below, the PHP team won’t be patching it, so you’ll need either a backport from your vendor or a proper upgrade.

Why This Isn’t Your Usual Plugin Problem 

Most PHP break-ins have a familiar culprit: a careless plugin, or a theme nobody has updated in years. The cleanup feels routine. You remove the offender, reset a few passwords and get on with your day. PHP2Shell breaks that pattern, because the problem isn’t in anything you installed. It lives inside the PHP engine itself, so even perfectly clean code can’t protect you.

Picture an apartment building where every tenant has fitted a solid lock, yet the main entrance is faulty. Upgrading your own deadbolt changes nothing. That’s exactly why WordPress said it won’t ship an update for this one: WordPress itself isn’t broken. Whoever manages the server has to do the repair, and on shared hosting that’s your hosting company, not you.

The scale is what makes people nervous. According to W3Techs, powers about 70% of all websites. VirusTotal, meanwhile, counts over 5.1 million hosts visible from the internet, and roughly 3.8 million of those have at least one open port.

What Went Wrong Inside PHP, in Plain English 

You don’t need a background in memory safety to follow this, so here’s the plain version.

CVE-2026-109618 kicks off when PHP runs short of memory in the middle of handling a request. Rather than tidying up properly, it can bail out while the request’s internal data is only half built. Researchers at Wiz tracked this down to a use-after-free bug in the code that manages session upload progress. They went on to show it can lead to remote code execution, with no login needed, on WordPress, Drupal and Joomla.

CVE-2026-109619 is a close relative. After a fatal error, some of PHP’s global variables are left pointing at memory that has already been freed. An attacker who understands this can influence what happens next.

Two details shape the real-world risk. For one, the reported attacks go through PHP’s session upload-progress feature, which is on by default and doesn’t need your application to call session_start. For another, the PHP security team sees mod_php as the riskiest setup, because a request can trigger the flaw before any of your own code gets a chance to run.

Which AI Found These Bugs, and Who Gets the Credit?

Here’s the twist that turned this into a global story: no lone hacker dug these flaws out. AI models did a lot of the heavy lifting, and three separate teams ended up reporting overlapping problems to the PHP project.

• Calif. This security firm used OpenAI’s GPT-5.6 Sol through OpenAI’s Patch the Planet program, which funds AI-assisted reviews of open-source code. Its first report reached PHP on August 11.
• Wiz. The cloud security company, owned by Alphabet, found both flaws on its own and reported them on August 24. Its researchers used their own Wiz Atlas system, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
• OpenAI. Its own team followed on September 18 with a report covering more ways to trigger the problem.

There’s a bit of a credit dispute. Open AI says it led the coalition and that frontier AI was the key. According to the Guardian, the researcher behind the first findhese among the most severe flaws ever found in PHP. said they used models anyone can access. Wiz, for its part, called these among the most severe flaws ever found in PHP.

And who is attacking? Nobody has been named. Amazon saw different payloads arriving through different anonymizing services, which points to several unrelated actors rather than one group. One more detail worth knowing: no source I found confirms that attackers used AI to exploit these flaws. The AI story so far is about defenders finding the bugs first.

Timeline: From Quiet Discovery to Mass Attacks 

• August 2026: Wiz Research, teaming up with Calif and OpenAI, spotted the flaws and quietly reported them to the PHP team.
• October 17: Amazon later revealed that one of its honeypots took an exploit attempt on this date, a full four days before any patch existed.
• October 20: PHP told admins that emergency fixes were on the way. Then the details, CVE numbers included, leaked online, and the team had to rush the release forward.
• October 21: The patched versions went live. CISA, the FBI and the NSA urged organizations to update right away.
• October 22: Amazon warned that PHP2Shell was being exploited widely, with new exploit attempts showing up within hours of the release. Cloudflare saw thousands of attempts in the ten hours before the announcement, and millions afterward.
• October 24 to 26: A security researcher at Perplexity ran a honeypot that appears to have caught genuine remote code execution against an Apache mod_php setup on PHP 8.4.26. Marcus Hutchins called it the strongest proof of real-world exploitation he’d seen. The researcher added an honest caveat: the test setup was deliberately favorable, so it tells us little about how reliable the exploit is on other servers.

A word of caution about the headlines. For the first few days, most reports described scanning and failed attempts, not confirmed break-ins, and an attempt isn’t the same as a compromise. That picture has been shifting, and reports suggest CISA has now confirmed exploitation. Before you quote anyone on this, check CISA’s Known Exploited Vulnerabilities catalog for the latest status.

How Much Damage Has PHP2Shell Done So Far?

The honest answer is a lot of noise, a lot of disruption, and so far surprisingly little confirmed harm.

• Attack attempts: Cloudflare’s CEO said his network saw thousands of attempts in the ten hours before the announcement and millions afterward.
• Confirmed break-ins: The first solid proof of real code execution came from a honeypot on October 24. Before that, reporting described no confirmed compromise of a major public administration, and Germany’s BSI and the Japanese government said they had not confirmed successful attacks. No data breach had been tied to the flaws at the time.
• Websites switched off: Banks, retailers, hospitals and government agencies took servers offline to install fixes. Government sites in the Netherlands and Finland went dark, France’s Interior Ministry pulled prefecture sites, Orange suspended PHP-based services at several subsidiaries, and Australian federal sites, including cyber.gov.au, went offline too.
• The size of the blackout: UptimeRobot recorded roughly 37,000 downtime alerts per minute at the peak on October 21, about eleven times its normal rate.

One caution before anyone declares victory: attempts are not break-ins, and break-ins tend to be discovered weeks later, not in real time. The damage count may well grow.

How the Internet Recovered

The loudest part of the crisis ended fast. Organizations that pulled their sites offline brought them back once the updated PHP was installed. One example: MSU Federal Credit Union in Michigan, an $8.9 billion institution, took its website and digital banking down on Wednesday, patched its systems, and had online and mobile banking running again on Thursday. It reported no impact on member information.

The quiet part is slower. Ox Security reported that roughly 99% of affected hosts whose PHP version it could identify still weren’t showing a patched version after 24 hours. CybelAngel’s analysis found that about 59% of 2.24 million internet-facing PHP hosts run versions with no official fix coming at all, which is why vendor backports and upgrades matter so much.

There was one reassuring note. On October 22, Sansec said mass exploitation looked less likely than it had feared on release day, because the public exploits need specific server conditions. Its advice was still to update PHP anyway.

Is Your PHP Version Affected? 

PHP branch	Support status	Fixed version
8.5	Active support	8.5.12
8.4	Active support	8.4.27
8.3	Security fixes only	8.3.36
8.2	Security fixes only, until 31 Dec 2026	8.2.35
8.1, 8.0, 7.4 and older	End of life	No official release

There’s one catch worth knowing. Debian, Ubuntu, RHEL and some long-term-support vendors often backport security fixes into older packages, which means a server showing an old version number might already be protected. So don’t assume it’s safe, and don’t assume it’s broken either. Your vendor’s security advisory is the one place that settles it, so read that before you decide anything.

How to Patch PHP2Shell Today: A 5-Step Checklist 

1. Find out which version you’re on. Run php -v on the server, or look in your hosting panel. If you’re on shared hosting, email your provider and ask which version your site runs and when it was patched. Ask for the answer in writing.
2. Update to a fixed release, or install the updated package from your distribution. The team has said plainly that updating is the only complete fix.
3. Restart everything. That means every worker, whether it’s PHP-FPM or Apache, plus any container images you need to rebuild. Patched files sitting on disk won’t help while the old code is still running in memory.
4. Begin with internet-facing systems. CISA also notes that often hides inside other software, so it may be running in places you wouldn’t think to check.
5. Look backward, too. Amazon’s security chief advised defenders to search for suspicious activity from October 17 onward, rather than assuming attacks only began on disclosure day. CISA also suggests keeping an eye out for unusual process activity on your PHP servers.

Update Your Version: Where to Get the Patched Release

If you manage your own server, the cleanest route is usually your operating system’s package manager, because that keeps the update tied to your distribution’s security channel. If you’d rather work from the source, the official release files live on the PHP downloads page. For the full story straight from the maintainers, read the PHP Foundation’s release announcement and CISA’s alert on the PHP flaws.

A few quick pointers by setup:

• Shared hosting: look for a version selector in your hosting panel, then pick 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your panel doesn’t list them yet, open a support ticket.
• WordPress: the Site Health screen in your dashboard shows which PHP version your site is currently running.
• Docker: pull the updated image for your branch and rebuild, then redeploy.
• Anything on PHP 8.1 or older: plan an upgrade to a supported branch, because no official fix is coming.

Can’t Patch Yet? Temporary Fixes That Buy You Time 

Sometimes a patch has to wait for a maintenance window. If that’s your situation with PHP2Shell, these steps can lower your risk in the meantime, but none of them is a substitute for the update:

• Set session.upload_progress.enabled=0 in php.ini or in your FPM pool configuration. Setting it through ini_set() or in .user.ini won’t count.
• On PHP 8.5, set fatal_error_backtraces=0 as well.
• Ask your hosting provider whether they can add a web application firewall rule. Think of it as a stopgap, nothing more.
• If you’re on PHP 8.1 or older with no vendor backport, CISA’s advice is blunt: take the affected systems offline until they can be updated or secured.

There’s also a separate and narrower problem. On October 23, the PHP team shared mitigation advice for CVE-2026-115560, an unpatched remote code execution bug that can only be exploited with an unusual mix of configuration and application code. For now the advice is the same: switch off session upload progress.

The Bigger Lesson: Patch Windows Are Shrinking 

People are already comparing PHP2Shell to Log4Shell, and not just because of how many sites it touches.

The patch window has nearly vanished. Details leaked before the release and attackers were already trying things before fixed versions existed. For a critical bug on an internet-facing server, the useful unit of time is hours, not days.

AI is also working for both sides. Researchers said AI-assisted analysis helped dig up flaws that had sat hidden in the code for years. The same kind of tooling can help attackers compare a patched release against the old one and rebuild the bug.

Finally, old version is the real long-term risk. Virus Total found that most servers that reveal their version are on end-of-life branches. A current list of what you run, plus a quick way to update it, will do more for you than any single firewall rule.

FAQ

This article is for information only. Always confirm version numbers and mitigations against PHP’s official advisories before changing production systems.