If you run a website, there is a good chance PHP is working behind the scenes, and this week it needs your attention. On Wednesday, October 21, the PHP project released emergency security updates for two critical vulnerabilities, nicknamed PHP2Shell, that can allow an unauthenticated attacker to execute code on servers running PHP.

PHP powers a huge share of the web, including WordPress, Joomla and Drupal sites. Here is a plain-English guide to what happened, who is affected and what to do about it.

What is PHP2Shell?

PHP2Shell is the collective name for two related flaws: CVE-2026-109618 and CVE-2026-109619. According to the PHP Foundation, both sit in parts of PHP that nearly every request touches: memory management and error handling.

  • CVE-2026-109618 involves out-of-memory corruption. If a request hits PHP’s memory limit at exactly the wrong moment, PHP can leave partially initialized internal data behind and later treat it as valid. On Apache with mod_php, the Foundation says an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings.
  • CVE-2026-109619 involves stale global state. A fatal error at the wrong point can leave internal state pointing to memory from a previous request, which a later request on the same worker could then use. The reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

The Foundation notes that the actual severity score is 9.2, not the 10.0 figure that circulated online before the release.

Who is affected?

BleepingComputer reports that the flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP security team said it considers the risk highest for mod_php.

The flaws were reported by researchers at the security firms Calif and Wiz, along with OpenAI. BleepingComputer also cites VirusTotal estimates of more than 5.1 million PHP hosts exposed online.

How to fix it

The fix is to update PHP. The patched versions are:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

PHP 8.1 and older no longer receive official updates. The PHP team says some Linux distributions and long-term-support vendors provide backported fixes, so check with your vendor or upgrade to a supported version. Given the severity, the team also published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP from source. U.S. cybersecurity agency CISA and the UK’s National Cyber Security Centre have both urged organizations to patch immediately, and the NCSC advised taking systems offline if they can’t be patched yet.

What if you can’t patch right away?

The PHP security team shared temporary mitigations, but stressed they do not fully protect against exploitation. For CVE-2026-109619, the suggested steps include disabling session upload progress tracking (session.upload_progress.enabled=0) and restarting every worker. For CVE-2026-109618, the guidance includes adjustments to memory and upload-size limits. Full details are in the PHP project’s advisory.

Cloudflare had deployed firewall rules aimed at known exploitation methods and, according to BleepingComputer, its CTO said the company was already seeing early attacks, while stressing those protections are temporary too. The message from everyone involved is the same: patching is the only real fix.

What website owners should do today

You don’t need to be a developer to act. A practical checklist:

  • Ask your host. If you use shared or managed hosting, contact your provider and ask whether PHP has been updated to a patched version. Many hosts handle this for you.
  • Check your PHP version. Most hosting control panels show it, and WordPress shows it under Tools, then Site Health, then Info, in the Server section.
  • Update supported versions promptly. If you manage your own server, install your distribution’s updated PHP packages and restart PHP services.
  • Plan an upgrade off old versions. If you’re on PHP 8.1 or older, this is a strong reason to move to a supported release.
  • Keep backups current. A fresh backup makes any update, or recovery, far less stressful.

A messy disclosure

The rollout didn’t go entirely to plan. The PHP Foundation says the CVE identifiers leaked online on October 20 with a wrong release time and score, prompting the project to move the release up by a day. It also says one research firm mistakenly published a proof-of-concept video, and that a distributor published patched images hours before the coordinated release. That compressed the time defenders had to prepare, which is one more reason to update quickly.

The bottom line

PHP2Shell is serious because PHP is everywhere. The good news is that a fix is out for every supported branch. If you own a website, take ten minutes today to confirm your server is running PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or that your host has patched it for you.

Image: Free computer code screen image via Rawpixel, CC0 1.0