PHP2Shell: what happened to PHP and how to check if your website is safe

On October 21, 2026, half the internet was patching servers in emergency mode. Two critical flaws in PHP let attackers take over websites without logging in.

PHP runs most of the web: WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel and thousands of custom-built systems. So when details of two critical flaws in the PHP engine itself leaked on October 20, this stopped being a problem with one plugin or one CMS. It became a problem for almost everyone with a website.

Government websites in the Netherlands, Germany and France went offline as a precaution. Hosting companies ran emergency maintenance through the night. UptimeRobot logged 11 times more "site down" alerts than the day before. The patches are out now. But a patch does nothing until someone actually installs it on your server.

What is PHP2Shell and what went wrong?

Both flaws are in how PHP handles memory while it processes requests. That's one level below WordPress or your own code. So even a plain "Hello World" page can be vulnerable if it runs on an unpatched PHP version.

• CVE-2026-109618 is triggered when PHP runs out of memory. A specially crafted request, similar to a normal form submission with a file upload, exhausts the memory. PHP stops halfway and leaves a mess behind that an attacker can use.
• CVE-2026-109619 is about memory shared between requests. One PHP process serves many visitors in turn. After an error, traces of a previous request can stay behind, and the next request reaches into memory that no longer belongs to it.

In practice that means two things. Remote code execution without logging in, so a full server takeover. And reading server memory that can hold other users' passwords, session tokens, API keys and certificates. Researchers at Wiz showed working attacks on current versions of WordPress, Drupal and Joomla.

How it unfolded

The uncomfortable part: the PHP Foundation admitted that early signs of one of the bugs surfaced during an external audit back in 2024. Work on a fix then stalled for months. The Foundation called it "a structural failure" and has changed how it makes security decisions since.

Is your PHP version affected?

This is the question that matters most, and the answer depends on which PHP branch your site runs on.

The first row is where the real problem sits. Scans quoted by Recorded Future show that around 79% of PHP services with a visible version run on unsupported branches. PHP 7.4 alone accounts for nearly 880,000 of them. If your site was built a few years ago and nobody has touched the server since, there's a good chance it's one of them.

Upgrading PHP is rarely a one-click job. Older themes, plugins and custom code often break on newer versions, which is exactly why so many sites stay stuck. It needs a short compatibility check first. Still far cheaper than cleaning up after a breach.

Not sure which version your site is on? Send us the URL and we'll tell you within one or two business days.

What has already happened

The biggest organisations didn't wait to be attacked. They pulled their own services offline before anyone could get in.

• The Netherlands: the National Cyber Security Centre's own website went dark, along with DigiD, MijnOverheid, the House of Representatives, the Port of Rotterdam, the largest political parties and many hospitals.
• Rest of Europe: government websites in Germany, France, Finland, Belgium and Czechia were taken offline as a precaution. Wikimedia shut down some of its systems. CERT-EU and the UK's NCSC told organisations to patch immediately.
• Business: BambooHR took its HR platform offline in the US, Canada and Ireland. In Japan, hosts such as Sakura Rental Server ran emergency maintenance, and Bloomberg reported banks and airlines switching off digital services.

At the peak on October 21, UptimeRobot was sending around 37,000 "site down" alerts per minute, about 11 times more than the day before. In Europe the jump was twentyfold. And as of October 22 no source had publicly confirmed a specific successful breach. Given how many servers are still unpatched, that's more a matter of time than a reason to relax.

What PHP2Shell can cost your business

It's tempting to treat this as an IT problem. It isn't. A compromised website touches sales, legal, finance and your reputation, usually all at once. These are the costs that show up most often when a web server is taken over.

AI and website security: the same weapon on both sides

PHP2Shell is one of the first high-profile vulnerabilities where AI played a big part in both finding the bugs and building working exploits. The flaws had been sitting in PHP for over a decade, with roots going back to research from 2004. They were found by Wiz Research together with Calif and OpenAI's Codex Security team, helped by AI models. According to Wiz, one researcher did in a week what "would have taken a world-class team months of work."

Calif is careful to add that the models didn't do it alone. Without someone who knew PHP's history and internals, there would have been no working exploit. AI didn't replace the expert. It made the expert much faster.

Three things follow for any business with a website:

1. The window to react is shrinking. Only 19 minutes passed between the patch release and the first attacks. The same tools that helped find the flaws help attackers adapt exploits to different versions and setups. Patching is now measured in hours, not weeks.
2. There will be more of these. If AI speeds up bug hunting in mature, heavily reviewed software like PHP, expect more alarms like this one, and not only in PHP.
3. AI helps defenders too. Google's Gemini team helped with the fix, and Cloudflare had protective rules live hours before the patch was public. The ones who come out fine have monitoring, backups and someone who acts straight away.

One warning. Don't ask a chatbot for a "fix" to paste onto your server, and don't install plugins that promise to patch PHP from inside WordPress. Patchstack explicitly warns against both. A flaw in PHP itself can't be fixed with a plugin.

What to do now: a PHP2Shell checklist

You don't need to be a sysadmin to handle this. You need to know what to ask, and who to ask.

Today

1. Check which PHP version actually serves your website. What counts is the version handling web requests, not the one php -v shows on the command line. Vendors often patch an old version without changing its number, so look for CVE-2026-109618 and CVE-2026-109619 in the package changelog.
2. Ask your hosting provider or server admin directly whether PHP is patched, and whether Apache, PHP-FPM and background workers were restarted afterwards. Without a restart, the patch doesn't take effect.
3. On PHP 8.1 or older? Check whether your OS vendor has shipped a backported fix. If not, plan the upgrade now, and aim straight for 8.4 or 8.5.
4. Skip the "fix" plugins and code pasted from forums or chatbots.
5. Can't patch right away? Your admin can apply temporary settings such as session.upload_progress.enabled=0 and a lower post_max_size. These only reduce the risk. Cloudflare's WAF rules help only if your server refuses traffic that bypasses Cloudflare. If you handle sensitive data, consider maintenance mode until you're patched.

This week

1. Take inventory. Every place PHP runs: staging sites, old landing pages, forgotten subdomains, containers, systems from third-party vendors.
2. Review your logs from October 20 onwards. Look for unusual multipart requests, out-of-memory errors, bursts of 500 errors, oversized PHPSESSID cookies and unexpected PHP worker restarts. Clean logs don't prove you're safe.
3. In doubt? Assume the server may have been compromised. Rotate passwords, API keys and tokens stored on it, since they may have leaked from memory. Scan files for unknown code. If personal data is involved, the 72-hour GDPR clock is running.

For good

Decide who owns updates. A named person or company, with response times measured in hours. Add uptime monitoring, backups you've actually tested and a supported PHP version. Then the next alarm is a routine task, not a crisis.

PHP2Shell FAQ

The bottom line

PHP2Shell wasn't a problem for one website or one CMS. It was a test of how fast companies can react when a critical flaw hits the foundations of the web. Some switched their services off and calmly rolled out the patches. Others still don't know which PHP version their site runs on.

The lesson is simple. Website security isn't a one-off project, it's ongoing care. Someone has to know what's on your server and act before an attacker does.

Sources

• Rapid7: CVE-2026-109618 and CVE-2026-109619 analysis
• Wiz: PHP2Shell research
• The Hacker News: emergency patches and timeline
• Recorded Future: exposure data
• Patchstack: guidance for WordPress site owners
• UptimeRobot: why websites took themselves offline
• CyberScoop: IBM Cost of a Data Breach 2025