PHP2Shell: critical PHP flaws hit most of the web, patches out

On 21 October the PHP team shipped emergency updates for two critical flaws in the language's core, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell. Both are rated 9.2 on CVSS 4.0 and let an attacker run code on a server with a single crafted web request, without logging in. Wiz Research found the bugs and coordinated the fix with the PHP team, Calif and OpenAI. Disclosure was planned for 22 October but moved up a day after details leaked.

According to Wiz, every PHP release of the past decade contains at least one of the bugs, going back to PHP 5.4. Because the flaws sit in the engine rather than in application code, even a "Hello World" page is exposed. Censys counts about 2.58 million internet-facing hosts and 54.9 million web properties running PHP. WordPress, Drupal, Joomla and Magento are all affected indirectly; Wiz demonstrated unauthenticated remote code execution against current WordPress, Drupal and Joomla images, and Sansec confirmed it against Magento 2.4.9 and ten other applications. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Cloudflare saw exploit attempts before the patch and deployed firewall rules; attackers changed payloads to slip past them. watchTowr reported active exploitation attempts against both flaws on 21 October, and Patchstack said hosting partners reported several incidents. As of 21 October, no successful break-in of a specific server had been independently confirmed. As a precaution, DigiD, MijnOverheid and the Dutch parliament's site, some Finnish government sites and the HR service BambooHR went offline.

Remote code execution means an attacker can make a server run commands without any access rights. Wiz also showed application-independent memory disclosure: reading a PHP worker's memory can expose passwords, session tokens and API keys. Researchers say AI models sped up turning the bugs into working exploits.

Wiz expects a long patching tail, comparing it to Log4Shell. PHP 8.1 and older get no official updates, only source backports, and PHP 8.2 reaches end of life on 31 December 2026. On shared hosting the provider picks the PHP version, so many small sites depend on how fast hosts move. Patchstack warns against unofficial "fix" plugins; updating PHP is the only complete remedy.

If your site runs on WordPress, WooCommerce, Joomla or any PHP system:

• Check your PHP version is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer.
• Get a written answer from your host on when it patched.
• Watch for warning signs such as repeated 500 errors, memory-limit errors and oversized session cookies; if you see them, rotate passwords and API keys.
• Static sites are not affected: pages served as plain HTML do not run PHP.