PHP2Shell, explained

PHP2Shell is the name for two critical flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 (CVSS v4). They let an attacker run their own code on a web server without logging in.

Why it is a big deal: PHP runs roughly 70% of websites, including sites built on WordPress, Drupal, Joomla, Magento, Laravel and MediaWiki. Every PHP version since 5.4 is affected by at least one of the two flaws.

How it was found: with the help of AI. Security firm Calif worked with OpenAI's GPT-5.6 Sol during an audit funded by OpenAI's Patch the Planet initiative, and Wiz Research used Gemini 4 Argon. The flaws were reported to the PHP team on 24 August 2026 and fixed on 21 October 2026.

Which versions are fixed: - PHP 8.5.12 - PHP 8.4.27 - PHP 8.3.36 - PHP 8.2.35 - PHP 8.1, 8.0 and 7.4 only got minimal source backports. - PHP 7.3 and older have no fix at all.

What is happening now: mass automated scanning began within hours of exploit code leaking. Most attacks plant web shells (a hidden back door into the server) and crypto miners. Palo Alto Networks counted more than 22.6 million exposed instances. Government sites in the Netherlands and Finland went offline as a precaution.

The fix is on the server, not in your website software. Updating WordPress, a theme or a plugin does not fix PHP2Shell. Only upgrading PHP itself does.

What to do: - Find out which PHP version your site runs. If you are not sure, ask your host. - Upgrade to one of the fixed versions above. - On 8.1, 8.0 or 7.4, ask your host whether the backports are applied, and plan a move to 8.2 or newer. - If you cannot patch soon, consider taking the site offline until you can, as some government agencies did.