PHP2Shell is the name used for two critical vulnerabilities in the PHP programming language: CVE-2026-109618 and CVE-2026-109619. The PHP team says the flaws can enable remote code execution without authentication. Both received a CVSS v4.0 severity score of 9.2. PHP published emergency security releases on October 21, 2026.
What is PHP2Shell?
PHP is a server-side programming language used by websites and web applications. The nickname PHP2Shell refers to a possible path from a crafted web request to command execution on a vulnerable server. Google Cloud’s technical summary describes one flaw in how PHP handles memory during an out-of-memory error, and another involving stale request data that can remain in a worker after its memory is freed. These are implementation flaws in PHP itself, so updating a website’s theme or plugins alone does not fix the runtime.
Successful remote code execution could let an attacker act with the permissions of the affected web-service process. Depending on that server’s permissions and configuration, the impact could include access to files or application secrets, changes to site content, or further compromise. The exact impact varies; a vulnerable version alone does not prove that a particular site was breached.
Which PHP versions are affected?
Google Cloud reports that versions from PHP 5.4 through PHP 8.5.11 are affected. The PHP project released patched versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are end-of-life and the project is not providing fixes for them; administrators running those versions should arrange migration to a supported branch with their hosting provider.
What should website owners do now?
- Ask the hosting provider which PHP version actually runs the live site, including any separate workers or staging systems.
- Upgrade promptly to the latest patched release in a supported branch and confirm the change took effect.
- If the host cannot patch, ask about isolating or temporarily disabling the affected PHP service while a safe upgrade is prepared. The PHP project says there is no complete workaround; updating is the safe fix.
- Review server and application logs for unusual requests or unexpected file changes, especially activity around the disclosure period. If compromise is suspected, involve the host or an incident-response professional, rotate exposed credentials and restore from a known-good backup as appropriate.
Amazon Threat Intelligence reported seeing an attempted PHP2Shell attack against a honeypot on October 17, four days before public disclosure. This confirms early targeting activity, but it does not establish that a given website was attacked or compromised.
Sources and image credit
PHP security releases · Google Cloud technical summary · Amazon Threat Intelligence. Photo: Tony Webster, CC BY 2.0.