PHP2Shell Vulnerability: Critical PHP Flaws Put Websites at Risk

Website owners have a serious PHP security issue to address. Known as PHP2Shell Vulnerability, two critical vulnerabilities in the PHP runtime could allow an unauthenticated attacker to execute code on a vulnerable server. That could put website files, databases, customer information and connected systems at risk.

The PHP development team released security updates on October 21, 2026, and India’s Computer Emergency Response Team (CERT-In) issued a critical advisory for organisations using PHP. Security researchers have since observed attempts to exploit the flaws, although the results reported by individual monitoring teams differ.

In an October 27 update, Wiz Research said its telemetry had recorded exploitation attempts but had not observed a complete, successful PHP2Shell exploit chain in its own monitoring. CERT-In, meanwhile, warned of widespread exploitation attempts. These statements are not contradictory: attacks may be attempted without succeeding in every environment.

For website owners, the practical message is straightforward: identify the PHP runtime serving your website, apply the appropriate security update, and investigate suspicious activity if the system may have been exposed. Updating WordPress or another PHP application alone may not fix a vulnerability in the underlying PHP runtime.

What Is the PHP2Shell Vulnerability?

PHP2Shell Vulnerability is the collective name for two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. They affect the PHP runtime, which processes server-side code used by websites and web applications.

Both vulnerabilities have a reported CVSS v4.0 severity score of 9.2 out of 10. The concern is that an attacker may be able to exploit a vulnerable installation without first logging in, potentially gaining the ability to execute arbitrary code on the server.

The two flaws have different underlying causes:

• CVE-2026-109618: An issue involving out-of-memory handling that can leave PHP internal request data in an unsafe state during error handling and cleanup.
• CVE-2026-109619: A use-after-free issue involving stale internal state that may be accessed after the memory it refers to has been released.

These are vulnerabilities in the runtime itself, rather than a single WordPress plugin or theme. Consequently, websites can be exposed even if their application code has not changed recently.

PHP’s official advisory identifies internet-facing PHP installations as needing urgent attention and notes that Apache deployments using mod_php face particularly high risk under the demonstrated exploit conditions.

Is PHP2Shell Being Exploited in the Wild?

Security agencies and researchers have reported attempts to exploit PHP2Shell since the vulnerabilities became public in October 2026. However, it is important to distinguish exploit attempts, successful demonstrations in controlled environments and confirmed compromises of production websites.

On October 23, Singapore’s Cyber Security Agency warned of widespread exploitation attempts. CERT-In’s October 22 advisory also warns of large-scale exploitation in the wild and urges Indian organisations to patch urgently.

Wiz Research’s October 27 report provides a more specific picture of its own observations. The team identified exploit attempts against PHP-based systems, including attempts that triggered memory exhaustion. However, the observed attempts did not complete the entire exploit chain in its monitored environments. Wiz also found tools labelled as PHP2Shell exploits that relied on separate application weaknesses rather than successfully exploiting the two PHP flaws.

These findings do not establish that every PHP2Shell attempt has failed, nor do they prove that a particular website is safe. Exploit reliability can depend on PHP builds, server configuration, memory limits and how requests are handled.

The important takeaway is that a lack of a confirmed compromise on one monitoring platform is not a reason to postpone patching. The PHP project has released fixes, and security researchers expect exploitation techniques to evolve.

Which PHP Versions Are Affected?

The PHP project says the vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP and LiteSpeed deployments. Fixed releases are available for the supported branches listed below.

These are the upstream PHP release versions that address the two PHP2Shell vulnerabilities. Linux distributions, managed hosting providers and long-term-support vendors may supply their own packages containing backported security fixes, so administrators should also check the security notice from their operating-system or hosting vendor.

PHP 8.1 and older branches no longer receive normal security updates directly from the upstream PHP project. Some vendors may provide backported fixes for older versions, but administrators should verify this rather than assume that an old installation is protected. If a supported, security-fixed package is unavailable, plan an upgrade to a supported PHP branch.

To verify the relevant fix, consult the official PHP security announcement and your hosting provider’s security documentation.

How to Protect Your Website From PHP2Shell Vulnerability

1. Update the PHP runtime immediately

Installing the appropriate security-fixed PHP release is the primary remediation. Administrators managing their own servers should update the PHP packages used by the actual web-serving processes, then restart or reload the relevant services as required.

Updating the command-line PHP binary alone may not be sufficient if the website uses a separate PHP-FPM pool, Apache module, container image or another runtime installation.

After the update, verify the PHP version used by the website itself. If a container or deployment pipeline is involved, rebuild and redeploy the affected image so that the running service includes the fix.

2. WordPress users: check your hosting account

WordPress runs on PHP, which means WordPress websites can be affected when their hosting environment uses a vulnerable PHP runtime. Installing the latest WordPress core, theme or plugin updates is good security practice, but it does not automatically patch the PHP engine.

If your website uses cPanel, look for a PHP version management tool such as MultiPHP Manager or contact your hosting provider. The exact menu and available versions vary by host.

1. Identify the PHP version assigned to the domain or hosting account.
2. Ask your host whether the active PHP runtime includes the PHP2Shell security fixes.
3. Switch to a supported, patched version if your host makes it available and your website is compatible.
4. Test the website, its plugins, forms, checkout process and administrative functions after the change.
5. Confirm with the host that the web-serving PHP process is using the fixed build.

If the host manages PHP updates centrally, ask for written confirmation of the patch status. Do not assume that the version shown by a separate command-line tool is necessarily the version serving your website.

3. If you cannot patch immediately, reduce exposure

The PHP project’s advisory describes temporary mitigations for specific exploit paths. These can reduce exposure while an update is being arranged, but they are not a substitute for installing a security-fixed runtime.

Depending on the environment, administrators can review request-size limits, multipart-request limits and the PHP session upload-progress setting. PHP specifically recommends disabling session.upload_progress.enabled as a mitigation for the confirmed path associated with CVE-2026-109619, with the setting applied before request parsing and the relevant workers restarted.

For CVE-2026-109618, PHP also describes temporary configuration and request-handling measures involving memory allocation failures and request-size limits. These controls must be applied carefully by a qualified administrator because inappropriate changes can affect website availability or functionality.

If a vulnerable internet-facing system cannot be patched promptly, restrict access to trusted networks where possible and contact the hosting or security team for assistance. PHP states that the only safe complete remediation is to update to a fixed release.

4. Check for signs of compromise

Patching closes the known vulnerability, but it does not remove an attacker who may already have gained access. If a server was exposed while vulnerable, review available logs and system activity for suspicious behaviour.

Look for:

• Unexpected changes to website files, PHP scripts or configuration files.
• New administrator accounts or changes to existing account permissions.
• Unfamiliar processes, scheduled tasks or startup entries.
• Unusual outbound network connections or unexplained requests to external services.
• Unexpected database changes, suspicious login activity or unexplained changes in website behaviour.
• PHP errors, unusual request patterns or repeated server failures around the period of suspected activity.

Logs may not capture every stage of an attack, particularly where exploitation occurs before application-level code executes. Treat a lack of suspicious WordPress activity as useful but incomplete evidence, not proof that the underlying server was never compromised.

5. Secure backups, credentials and administrative access

Maintain recent backups that are isolated from the website’s normal write access, and test that they can be restored. If an investigation indicates that an attacker may have accessed the system, preserve relevant logs and evidence before rebuilding or restoring files.

Rotate credentials that may have been exposed, including hosting control-panel passwords, database credentials, deployment keys and API secrets. Use unique passwords and multi-factor authentication wherever supported.

If code execution or server compromise is confirmed, simply restoring the homepage or removing an unfamiliar file may not be enough. Investigate persistence mechanisms, review access permissions and involve the hosting provider or a security professional before returning the system to normal operation.

What Should Indian Website Owners Do?

CERT-In’s advisory specifically targets micro, small and medium-sized enterprises using PHP. This is relevant to Indian businesses operating WordPress sites, online stores, customer portals and other PHP-powered applications.

Smaller organisations may not manage the PHP runtime directly. In shared hosting, the provider may control the underlying software, while the website owner controls only the domain’s PHP selection and application files.

In that situation, website owners should contact their hosting provider and request confirmation that the PHP2Shell fixes have been applied to the runtime serving their domains. If a security-fixed runtime is not available, ask for an urgent remediation timeline and whether access can be restricted until the update is complete.

Businesses should also check less obvious locations where PHP may be installed, such as staging websites, old applications, internal tools and third-party software. CERT-In advises organisations to identify PHP use across their infrastructure, even where the primary website does not appear to use it.

If suspicious activity or a compromise is identified, preserve evidence and follow the incident-reporting procedures described in CERT-In’s advisory. The advisory lists incident@cert-in.org.in for reporting incidents with available evidence.

Latest PHP2Shell Updates as of October 28, 2026

• October 21: The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address CVE-2026-109618 and CVE-2026-109619.
• October 22: CERT-In issued advisory CIAD-2026-0052 for Indian MSMEs using PHP, rating the risk critical.
• October 23: Singapore’s Cyber Security Agency updated its advisory with additional monitoring guidance and a warning about exploitation attempts. The PHP project also published an informational advisory recommending that a specific, unusual session configuration disable upload progress until a further fix is available.
• October 27: Wiz published findings from its monitoring, describing observed attempts and failed exploit chains in its own telemetry while cautioning that the risk remains.
• October 28: The main action remains to deploy a security-fixed PHP runtime, verify the running version and investigate any signs of prior compromise. No universal temporary configuration change replaces the patch.

These updates show why website owners should use current vendor guidance rather than rely on the first reports published when the vulnerability became public.

Frequently Asked Questions (People Also Ask)

PHP2Shell Vulnerability: The Bottom Line

PHP2Shell Vulnerability is a critical security issue because it targets the runtime that powers many websites and may allow an attacker to execute code without logging in. The two vulnerabilities have been patched in current PHP releases, but website owners must confirm that the actual runtime serving their sites has received the fix.

For WordPress users and small businesses, the immediate priority is to contact the hosting provider or administrator, verify the active PHP version and apply the relevant security update. Then review logs, check for unexpected changes and protect backups and credentials if exposure is suspected.

Do not wait for proof that your individual website has been targeted. Patch the vulnerable runtime, verify the result and treat any suspicious activity as a separate incident that may require investigation.

Follow The Smart Innovator™ for more such cover stories. Subscribe to our Newsletters for tech world updates. Interested in Hindi Technical contents? Follow दी स्मार्ट इनोवेटर