On October 21 2026 the PHP project issued emergency security updates for two flaws in the PHP engine. These flaws are now known together as PHP2Shell. They let an attacker run code on a web server without the need to log in. That means the attacker can take over the server or do things on the server without permission. Since PHP is used by 70% of websites including popular platforms like WordPress, Drupal and Joomla this is a big deal. It’s one of the important patches released all year.

If your website, store learning management system or business portal runs on PHP this post will explain what went wrong who is, at risk and what you need to do right away. The issue is real and urgent. Don’t wait. If you’re using PHP you need to act.

What is PHP2Shell?

PHP2Shell is the nickname for two related memory‑safety flaws, in PHP tracked as CVE‑2026‑109618 and CVE‑2026‑109619. Both are rated CVSS 9.2 (Critical). The name was coined by Wiz Research, who found the issues together with Calif and OpenAI Codex Security and reported them to the PHP team through coordinated disclosure.

The important point: the flaw is in PHP, not in your website’s code. Even a simple Hello World page can be exposed if the Hello World page runs on a PHP version. Updating WordPress, updating a plugin or updating a theme does not fix the Hello World page because the problem sits underneath the WordPress application.

What are the two vulnerabilities?

• CVE-2026-109618, out-of-memory (OOM) corruption.

When PHP runs out of memory at the wrong moment, it can be left with half-initialized internal data that later cleanup treats as valid.Attackers can chain this to run code as the PHP web worker without authentication. Researchers demonstrated it against WordPress, Drupal and Joomla.

• CVE-2026-109619, stale global state.

Some PHP global variables keep pointing at memory that has already been freed (a use‑after‑free). This can leak data from PHP worker memory or lead to code execution. It was also demonstrated against WordPress and Drupal, along with application-independent memory disclosure.

What can attackers do?

• Take control of the server. Run commands without credentials, then access data, move to other systems or deface websites.
• Read memory. Read memory. This can reveal passwords, authentication tokens, API keys and certificates that belong to users or, to the server.
• Steal data quietly. Memory disclosure does not require code execution first so it can be more difficult to detect using tools that only scan for code.
  
  

Which PHP versions are. Which are fixed?

The researchers found that many PHP versions have been affected. In fact the problems start with PHP 5.4 so every PHP version has at least one issue.
The first fixed releases are:

• PHP 8.5: upgrade to 8.5.12 or later
• PHP 8.4: upgrade to 8.4.27 or later
• PHP 8.3: upgrade to 8.3.36 or later
• PHP 8.2: upgrade to 8.2.35 or later

Anything older than the listed releases is vulnerable. I think you should be aware of that. PHP 8.1 and earlier branches are no longer supported and did not receive any official updates so I recommend you check whether your hosting provider or Linux distribution has back‑ported the fix or plan a migration. PHP 8.2 itself will also stop receiving support on December 31 2026 which means PHP 8.2 is also vulnerable after that date.

Was it exploited?

Amazon Threat Intelligence reported seeing an exploitation attempt, on October 17 four days before the disclosure and security vendors have since reported additional exploitation attempts after the technical details leaked. Proof‑of‑concept code is also circulating on GitHub so it confirms attackers already have working tools and PHP can be exploited if you do not act.

Update: a third issue, CVE-2026-115560

On October 23, PHP disclosed a separate vulnerability, CVE-2026-115560. It is not fixed by the October 21 releases, and it is not part of PHP2Shell itself. It requires an uncommon set of conditions:

1. session.serialize_handler is set to php_binary or php_serialize,
2. application code switches it to php at runtime (using ini_set()) before session_start(), and
3. session.upload_progress.enabled is still on (it is on by default).

PHP considers this setup unlikely and plans the fix for its next regular bugfix release. Until then, the recommended protection is to set session.upload_progress.enabled = 0. At the time of writing, we found no report of that fixed release yet, so check php.net for updates. Applications that never change the serialize handler while the program is running do not show up on this path.

What should you do now?

1. Check your PHP version. Run php -v. Remember that the command line and your web server can use different PHP versions. On hosting check your control panel or ask your provider.
2. Upgrade PHP. Install a fixed release (or your distribution’s patched package) on every server and container image.
3. Restart services. After upgrading restart Apache, PHP‑FPM and any long‑running PHP workers. Until then old code may still be running in memory.
4. Disable session upload progress. Set session.upload_progress.enabled = 0 in php.ini or your PHP‑FPM pool configuration then restart the workers. Settings applied later through.user.ini or ini_set() may come late to help.
5. Watch your logs. Look for unusual requests, unexpected PHP crashes and new or modified files, and rotate secrets if you suspect exposure.

What if you cannot upgrade immediately?

PHP states that updating is the only complete fix. These short-term steps lower exposure to certain attack routes and could impact how stable things are so make sure to try them first:

• Set memory_limit equal to -1 so that the memory limit process used by one attack route is not started. This sends memory exhaustion handling, to the operating system so use a Linux cgroup v2 limit (memory.max) to keep resource use under control. Do not use RLIMIT_AS or RLIMIT_DATA as a replacement because they can start the problems.
• Turn off PHP error display. On PHP 8.5 fatal-error backtraces (fatal_error_backtraces = 0).
• Disable session upload progress, as described above.
• Limit what a compromised PHP worker could reach: least-privilege accounts separated sites and restricted connections.

A web application firewall (WAF) or CDN rule can add a layer, but treat it as a stopgap, not a replacement for patching.

Hardening after you patch

• Review memory_limit against real application needs and undo any temporary -1 setting.
• Keep post_max_size sensibly below your memory budget while still allowing legitimate uploads.
• Set max_input_nesting_level to what your forms actually need.
• Optionally set expose_php = 0 to hide the PHP version. This is good practice but does not fix PHP2Shell.

Final thoughts

PHP2Shell is a reminder that keeping a website safe means making sure every part of the system is protected, from the program itself down to the language that runs it. It is also important because research done with the help of intelligence found problems that were in a well-known code for many years. For companies in Sri Lanka that use WordPress or their own PHP websites, on shared hosting the steps to take are easy: check the PHP version with the hosting provider apply the update restart the system and turn off session upload progress until the next fix comes out.

Further reading

• PHP security advisories and release announcements (php.net)
• The PHP Foundation: “Today’s PHP security release and how we’re strengthening PHP security” (thephp.foundation)
• Wiz Research: “PHP2Shell” technical post (wiz.io/blog/php2shell-php-rce) and the Wiz-run summary site (php2shell.com)
• OpenAI: “Patch the Planet” coordinated disclosure post (openai.com)
• Help Net Security, BleepingComputer and Recorded Future coverage of the patches and exploitation attempts