PHP2Shell Explained: The PHP Flaws That Pushed Websites Offline This Week
This week, the people who maintain PHP rushed out emergency fixes for two critical security holes, nicknamed PHP2Shell, that let attackers run their own code on web servers without logging in. Because PHP quietly powers a huge share of the web, some organizations pulled their sites offline while they patched. Here's what happened, how the flaws work in plain English, and what you should do whether you run a website or just use them.
What happened
On October 21, 2026, the PHP project released fixed versions for two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. (A CVE is simply a public ID number for a specific security bug, so everyone can talk about the same problem.) Both are rated 9.2 out of 10 on the CVSS v4.0 severity scale, which puts them firmly in the critical bucket.
If PHP is new to you, think of it as the engine that runs on a web server and builds a page before it reaches your browser. WordPress, many online shops, and countless company portals run on it. BleepingComputer notes that PHP powers roughly 75% to 80% of all websites, so a flaw in PHP itself, rather than in one app, touches an enormous number of sites at once.
The bugs were found by researchers at Wiz Research, the security firm Calif, and OpenAI's Codex Security team, who worked with the PHP security team and Google's Gemini team on the fix, according to The Hacker News. PHP had planned a coordinated release for October 22, but Dark Reading reports the embargo broke when a proof-of-concept attack tool called "PHP2Shell" surfaced, and the patches landed on October 21 instead.
How the attack works, in plain English
Both flaws live in the PHP runtime, the core software that executes PHP code, not in any particular website's code. That's why they reach so far. They affect every common way of running PHP for the web, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says the risk is highest for mod_php, where PHP runs inside the Apache web server itself.
The first flaw, CVE-2026-109618, is about running out of memory. When a request ends abnormally because it hit its memory limit, PHP can leave its memory in a corrupted state. An attacker who triggers that on purpose can turn the mess into running code of their choosing.
The second, CVE-2026-109619, involves what researchers call stale global state: leftover information from one request that carries over into the next request handled by the same worker process. That leads to a use-after-free, which means the program keeps using a chunk of memory after it has already handed it back. Attackers can abuse it to run code, and also to read the worker's memory. Qualys warns that leaked memory can expose passwords, login tokens and API keys.
Here's an analogy. Picture a busy restaurant kitchen where cooks reuse the same prep station from one order to the next. Normally the station gets wiped down between orders. But if an order is abandoned halfway through, the cleanup step gets skipped. A crafty customer could deliberately place a broken order to leave something behind on the station, knowing the next cook will grab it without checking. PHP2Shell works a lot like that: a carefully crafted request leaves the kitchen in a bad state, and the next step uses what was left behind.
The worrying part is the low bar. Security firm watchTowr told Dark Reading that an attacker doesn't need to log in; reaching the server over the network is enough. One confirmed path uses session upload progress, a PHP feature that's turned on by default.
Why AI is part of this story
These aren't brand-new mistakes. Wiz told Help Net Security the flaws had been present for decades. The Hacker News reports that a PHP core developer first spotted signs of the out-of-memory problem during PHP's 2024 external security audit, but nobody found a way to turn it into a working attack back then. This year's reports, which used AI tools, established the working exploit.
That's the bigger lesson. AI is helping researchers dig up old, subtle bugs and prove they're exploitable much faster than before. Defenders benefit, but so can attackers, and the window between a bug becoming known and someone trying to use it keeps shrinking. In this case, Amazon's threat intelligence team told Help Net Security its honeypot (a decoy server set up to attract attackers) recorded an exploitation attempt on October 17, four days before public disclosure.
How the industry responded
The response was fast and, in places, dramatic. Cloudflare put temporary firewall rules in front of PHP sites on its network, free for all customers. Those rules act as a filter that inspects incoming traffic and blocks requests that look like the attack. By the afternoon of October 21, watchTowr reported active exploitation attempts against both flaws, though at that point no source had confirmed a successful break-in.
Some organizations chose to go dark rather than gamble. Dark Reading reports that the Netherlands' National Cyber Security Centre took websites and services down while it patched, and The Hacker News says BambooHR and some Dutch government and education sites went offline as a precaution. The UK's NCSC urged organizations to consider taking offline any system they couldn't fix right away. Singapore's Cyber Security Agency issued an alert telling organizations to patch immediately.
There's also a long tail problem. Qualys says that, across PHP installations its customers scan where the version is known, about 70% run versions that are past end of life, meaning they no longer get official updates. PHP 8.1 and older are already unsupported, so those sites can't simply click "update" and be done.
What this means for you
If you run your own server or manage PHP sites:
Update now. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Then restart every PHP worker, because the second flaw abuses state that lingers in reused workers.
Check your Linux distribution's packages carefully. A patched package may keep an old-looking version number, so look for the CVE IDs in the changelog.
On PHP 8.1 or older, move to a supported branch or get a backported fix from your vendor. PHP's temporary settings changes, like disabling session upload progress, help but don't make an unpatched server safe.
Look for warning signs of an earlier break-in: odd multipart requests followed by memory-limit errors or repeated HTTP 500 errors, unusually large PHPSESSID cookies, unexplained worker restarts, and PHP processes launching shells or download tools.
If your site lives on a managed host or website builder, the server side is usually your provider's job. It's still worth checking their status page or asking support whether they've patched for PHP2Shell, especially for a self-hosted WordPress site on shared hosting.
And if you're just someone who uses websites, there's nothing for you to install. The practical step is the usual one: use unique passwords for each site, turn on two-factor sign-in where you can, and take breach notification emails seriously over the next few weeks.
The bottom line
PHP2Shell is a reminder that some of the web's most important plumbing is decades old, and that AI is now helping people find the cracks faster than ever. The fixes are out and they work. The real risk sits with servers nobody remembers to update, so if you're responsible for one, make this the week you check.
