Shayan

ENSV

Let's talk

PHP2Shell: the critical PHP flaws under attack, and how to check your site

By · Published · 2 min read

Short answer

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP that can let an attacker run code on a server without logging in. PHP patched them on 21 October 2026, and CISA listed them as exploited on 26 October. If your site runs PHP, it should be on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer.

Lessons from this story4 points ▾
  • Check the exact versionSafe means 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. If you can’t see the number, ask your hosting company today.
  • Restart after updatingTenable points out that new packages don’t help processes already running. PHP and the web server have to be restarted.
  • Leave old PHP behindPHP 8.1 and older get no normal release of the fix. Move to a supported version, or ask your host what they have patched.
  • Patch within daysAmazon saw the first attempts four days before the fix was out. Apply security updates quickly, then look through your logs.

What happened

PHP released fixes on 21 October after details of the flaws leaked. Amazon’s threat team had seen a first attempt against its honeypots on 17 October, four days earlier. On 24 October a researcher reported working attacks against test servers running PHP 8.4.26, and on 26 October CISA added both flaws to its catalogue of exploited vulnerabilities.

Both flaws are rated 9.2 and need no login. PHP runs on about 69% of websites with a known server language, according to W3Techs. Estimates of what’s exposed range from 1.3 million potentially vulnerable servers to more than 5 million PHP servers online.

Who is affected

Any PHP installation that answers web requests, whether it runs as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. PHP considers the risk highest with mod_php. Tenable also reports researchers showing attacks against specific versions of WordPress, Drupal, Joomla and Magento.

A third flaw, CVE-2026-115560, needs an unusual setup. It had no patch when the Canadian Centre for Cyber Security last updated its alert on 27 October. The workaround is to set session.upload_progress.enabled=0.

How to check your site

Look up the PHP version in your hosting panel, or run php -v on the server. Some servers also show it in the X-Powered-By response header. I checked two of the sites I look after the day I wrote this: 8.3.36 and 8.2.35, both patched.

What this means for your site

Most small companies don’t run PHP themselves. Their hosting company does, so an update might already be done, or it might not. An old version chosen years ago stays where it is until someone changes it.

Three checks worth doing today:

  • Find your exact PHP version and compare it with the numbers above.
  • If you run your own server, update and restart PHP and the web server.
  • Look for unexpected processes, files, accounts and outgoing connections.
Contact me

Sources

  1. Canadian Centre for Cyber Security (opens in a new tab)
  2. CISA Known Exploited Vulnerabilities (opens in a new tab)
  3. Tenable (opens in a new tab)
  4. BleepingComputer (opens in a new tab)

More hacks

  1. Binance

    $6.3 billion

    Most of it moved in about 20 minutes. It may have begun with one laptop.

  2. Node2Shell

    Node.js 22, 24, 26

    A flaw in the Brotli decoder inside Node.js. On CISA’s list of exploited flaws.

  3. Denmark

    8.8 million people

    Names, addresses and ID numbers, reached through one firm’s legitimate access.