What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. Because the flaw sits in the runtime rather than in one application, anything built on PHP could be exposed: WordPress, Drupal, Laravel, Magento or your own custom code.
If exploited, an attacker could take over the server and from there steal data or credentials, plant malware, alter websites, hide a foothold for later, move into connected systems or knock services offline.
Both are rated 9.2 out of 10 (CVSS v4.0). Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are end-of-life and won’t be patched, so they need replacing. The PHP.net security advisory and your vendors’ notices remain the final word.
Every sector runs PHP, so exposure is global. Your risk is highest if you have:
- Internet-facing servers, portals or online stores
- Old or unsupported PHP versions
- Apps that handle file uploads or heavy request processing
- Sensitive, payment or regulated data
- Legacy systems with no clear owner
Don’t forget the less obvious places: test and disaster-recovery environments, containers, managed hosting, supplier-run systems and control panels that assign different PHP versions per site. Your servers and suppliers may also sit in different countries from you, which affects which regulations apply.
How to fix it, by environment
Your own servers. Confirm the version, apply the fix, restart services and check every app is actually using the patched runtime. Test critical functions afterwards.
Managed hosting and cloud. Get written confirmation from your provider: what was patched, when, which accounts and environments were covered, whether logs were reviewed, and anything you still need to do.
Containers. Update the base image, rebuild, redeploy and remove old instances. Check your pipelines and image repositories so the vulnerable version doesn’t sneak back in.
Can’t patch yet? Remove or restrict internet access (VPN or allowlist), disable risky features, step up monitoring and document the delay. The NSA’s advice is blunt: take it offline until it’s fixed. Temporary controls are a stopgap, not a cure.
What the NSA recommends
In its 21 October advisory, the US National Security Agency warned that attackers are likely to weaponise PHP2Shell. It stressed that the flaws sit in PHP itself, not in your application or its settings, so any server running an affected version can be exploited. Its guidance:
- Inventory every system and service that relies on vulnerable PHP versions.
- Apply PHP’s patch and any vendor patches tied to PHP2Shell, and keep watching for new ones.
- Add enhanced logging across your network and operational environments.
- Replace end-of-life PHP services that can’t be patched.
- If you can’t update immediately, take the system offline until it’s fully mitigated.
Read the full advisory: NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
A patch closes the door. It doesn’t tell you whether someone already walked through it. Check logs and alerts from before you patched for:
- Odd web requests, new files or scripts, or configuration changes
- New accounts, processes or scheduled tasks
- Unexpected outbound connections
- Unusual database, cloud or login activity
Save logs before they rotate. If something looks wrong, stop making unnecessary changes and start incident response. If personal, payment or regulated data may be involved, check your legal, contractual and notification obligations.
Being affected isn’t proof of a breach. But quiet logs aren’t proof you’re safe either.
PHP2Shell is a test of resilience, not just patching. Can you name every service that runs PHP? Push an urgent fix quickly? Prove the fix is live? Show evidence that nothing happened before it?
A working website isn’t the same as a secure one, and a finished update doesn’t mean you weren’t compromised.
Start with three questions today:
- Which of our services run affected PHP versions?
- Are the fixes applied and verified?
- What evidence shows we weren’t compromised before we patched?
What you do next matters.
