PHP2Shell vulnerabilities expose web-facing PHP systems to takeover
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, have prompted broad emergency patching across internet-facing services. Dubbed PHP2Shell, the flaws can give an attacker remote control of an unpatched PHP system without requiring a password or any user interaction.
The PHP Foundation released fixes on Wednesday after coordinating disclosure with major internet companies and web hosts. Organisations in sectors including banking, retail, healthcare, gaming and government temporarily took websites and services offline while applying updates.
Why PHP2Shell is a high-impact risk
The vulnerabilities are classified as unauthenticated remote code execution. In practice, a remote attacker who can exploit an affected system may be able to access or alter data, install malware, or establish persistent access. The risk is especially acute for exposed servers, but PHP is also used in developer tooling, command-line packages and components embedded in routers, storage devices, firewalls and VPNs.
PHP has been deployed for decades and remains a foundation for a large part of the web. The source estimates that around 70% of web-facing internet services rely on PHP, including software ecosystems associated with WordPress, Drupal, Joomla and MediaWiki. That reach makes patching dependent products and locally hosted applications as important as updating public-facing websites.
Disclosure did not eliminate exploitation
Researchers at Calif had identified the underlying flaws in 2024, when they were not thought to be exploitable. A later security audit found a way to exploit them, leading Calif to notify the PHP Foundation. Calif participated in the Hack the Planet initiative involving OpenAI and Wiz; the researchers said AI assisted their exploitation work, while existing knowledge of PHP’s codebase and exploitation history remained central.
Amazon reported detecting PHP2Shell exploitation about a week before the patches were publicly available and advised defenders to investigate activity as far back as October 17. The PHP Foundation said one company published patches before the embargo ended. The early exploitation observed by Amazon, however, was not fully explained by that disclosure timing.
After public disclosure, Cloudflare saw an exponential increase in exploitation attempts. Palo Alto Networks and Trail of Bits also reported confirmed compromises and post-exploitation activity. Researchers expect additional exposure among smaller teams, sole developers and organisations running legacy systems or products that bundle PHP and need their own vendor updates.
What organisations should do now
Teams should identify all internet-facing and internal PHP deployments, including appliances and supplier-managed products, then install the relevant PHP or vendor-provided fixes. They should also review logs and endpoint evidence for suspicious activity from October 17 onward, because patching removes the exposed condition but does not remove an attacker already present.
Where immediate updating is unavailable, organisations need to reduce exposure while confirming a supported remediation path. The practical priority is to treat PHP2Shell as an estate-wide asset and incident-response task, rather than limiting the response to the main corporate website.