PHP2Shell Vulnerability: Is Your Website at Risk?

Two critical security vulnerabilities discovered in PHP — the programming language that powers roughly 70% of the world's websites — have put the internet on alert. Known collectively as PHP2Shell, the flaws could allow attackers to run malicious code on vulnerable web servers without needing to log in.

Emergency fixes were released on 21 October 2026 after details of the vulnerabilities leaked online a day early, forcing the PHP Foundation to rush out its announcement. Since then, cyber agencies including CISA, the NSA and NHS England have urged every PHP site owner to update immediately.

But how do you know if your website is actually affected? Here's what PHP2Shell is, which versions are vulnerable, how AI uncovered it — and what to do next.

What Is the PHP2Shell Vulnerability?

PHP2Shell refers to two newly disclosed vulnerabilities in the PHP engine itself:

• CVE-2026-109618 — an out-of-memory handling flaw. When a request runs out of memory mid-way, PHP's cleanup can treat partially initialised data as valid — opening a path to remote code execution.
• CVE-2026-109619 — a stale global state (use-after-free) flaw. A PHP worker can retain references to memory from an earlier request, which a later request can reuse — enabling remote code execution and, in some cases, disclosure of sensitive process memory.

Both carry a critical CVSS score of 9.2 out of 10 and can be exploited without any login or user interaction.

Crucially, the bugs live inside PHP itself — not in WordPress, Drupal or any plugin. Every runtime that serves web requests is affected, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. As the researchers put it, even a bare "Hello World" script on an unpatched server is vulnerable. Security firm Wiz demonstrated unauthenticated code execution on WordPress, Drupal and Joomla, plus memory leaks capable of exposing passwords and API keys.

Which PHP Versions Are Affected?

Every PHP release from 5.4 to 8.5.11 contains at least one of the flaws. The PHP team shipped fixes on 21 October for the four supported branches:

PHP branch	Patched version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and older no longer receive upstream security fixes. Some vendors ship backported patches through long-term-support packages (Ubuntu LTS, Debian, RHEL) — but a backport may not change the version number your site reports. If your host claims one applies, ask for written confirmation.

How Many Websites Run PHP?

This is what makes PHP2Shell unusually serious. According to W3Techs, PHP powers 69.3% of all websites whose server-side language can be detected — nearly seven in ten sites on the internet.

Server-side language	Share of websites
PHP	69.3%
JavaScript (Node.js etc.)	8.2%
Ruby	7.1%
Java	5.5%
Scala	5.0%
ASP.NET	4.2%

PHP is the engine behind WordPress — which alone runs roughly 43% of all websites — plus Drupal, Joomla, Wikipedia's MediaWiki, Magento and Laravel. And the version split is worrying: W3Techs data shows 26.9% of PHP sites still run PHP 7 and 7.7% run PHP 5 — branches that receive no upstream PHP2Shell patch at all.

Did AI Really Discover PHP2Shell?

Yes — and that may prove to be the most consequential part of this story.

The underlying bugs had lurked in PHP for more than a decade. An external security audit in 2024 flagged related issues, but no action was taken at the time. What changed was the arrival of frontier AI code-review tools capable of chaining the extraordinarily complex exploitation steps that had been, in Wiz's words, "at the edge of what human researchers could practically achieve."

• Security firm Calif reported the vulnerabilities on 11 August, after researcher Ryan A. used OpenAI's GPT-5.6 Sol to analyse the PHP codebase. Read more about GPT-5.6 Sol.
• Wiz Research independently found the same flaws using its Wiz Atlas security agent alongside GPT-5.6 Sol and Google's Gemini 4 Argon.
• OpenAI's Codex Security team (researcher Amy Burnett) and Trail of Bits also surfaced the vulnerabilities during AI-assisted audits.

Then came the leak. On 20 October, details began circulating in online forums — and Calif accidentally published a proof-of-concept video demonstrating the exploit chain. Although it was quickly removed, the PHP Foundation fast-tracked its patches, releasing them 24 hours earlier than planned on the morning of 21 October.

The uncomfortable corollary: if AI can find bugs this deep, it can also help write exploits for them. Matt Suiche's team at Tolmo reportedly produced a working exploit in under a day — a task that would previously have taken weeks. It's the clearest demonstration yet that what AI can do with code cuts both ways.

Which Websites and Services Have Been Affected by PHP2Shell?

First, an important distinction: being affected by PHP2Shell does not mean a website has been hacked. As of 23 October, security companies have confirmed widespread exploitation attempts — but no publicly verified successful breach. Most documented impacts are precautionary: organisations taking services offline to patch before attackers could strike.

The disruption has still been substantial. StatusGator counted 213 services publishing PHP-related status notices by early 22 October — 69 marked down and a further 32 entering maintenance. Named examples include:

Website or organisation	Reported impact	Source
BambooHR	Took parts of its HR platform offline for emergency patching on 21 October	Status page
DigiD & MijnOverheid	Dutch government authentication and citizen services temporarily taken offline as a precaution	NOS
Dutch Parliament (Tweede Kamer)	Among the government services taken offline	NOS
Tweakers & RTL Netherlands	Dutch technology and news services experienced disruption	NOS
Teamleader Focus	Business software platform temporarily shut down to reduce exposure	StatusGator
CCV Shop	Merchant webshops temporarily taken offline as a precaution	StatusGator
Dropbox Sign	Emergency maintenance disrupted e-signature integrations used by other services	StatusGator
DENIC	Germany's .de domain registry operator temporarily took its website offline	StatusGator
Finnish government services	Some government websites taken offline while risks were assessed	Check Point

These are documented operational impacts — not confirmed data breaches.

Which Security Companies Have Detected PHP2Shell Attacks?

Alongside the precautionary outages, security firms have logged real attack traffic — starting before the patches were even public:

Organisation	What they observed	Source
Amazon	An exploitation attempt hit its MadPot honeypots on 17 October — four days before public disclosure — launched from anonymised infrastructure, with further attempts within hours of the patch release	AWS Security Blog
Cloudflare	Attack traffic targeting customer sites, including payloads modified to evade WAF rules	Cloudflare
WatchTowr	Broad exploitation attempts after the patch — though most of the initial circulating PoCs "either don't work at all, test for timing differences, or crash the target"	SecurityWeek
Sophos	Blocked attempts delivering "Potassium", a Mirai-variant botnet payload; it corrected an earlier claim of successful exploitation — no confirmed compromise	Sophos
Vercel	Received advance notice under embargo and deployed protective WAF rules before disclosure	Vercel
Government agencies	Urgent-patch advisories telling operators to update immediately	CISA · NSA · NHS England · NCSC

Amazon's discovery is particularly significant because its MadPot honeypots detected a PHP2Shell exploitation attempt on 17 October 2026 — four days before public disclosure. However, Amazon says it remains unclear how the actor obtained information about the vulnerability, or whether the attempted exploit would have succeeded against a real-world system. The incident illustrates why rapid patching is essential, even before widespread successful exploitation has been confirmed.

How to Check if Your Website Is Vulnerable

Start by finding the PHP version that actually serves your site. You can usually find it in your hosting control panel (cPanel → MultiPHP Manager, Plesk → PHP Settings), in WordPress under Tools → Site Health → Info → Server, or via SSH with php -v.

Not sure where to look? Our free PHP Security Scanner can help in two ways: a passive website scan that inspects public signals for PHP fingerprints and the patched releases — no exploit traffic — and an unlimited version checker that compares any version you enter against the official fix list.

Honest caveat: most servers hide their PHP version, so a public scan can't always confirm it. An "unverified" result doesn't mean you're safe — and a clean scan can't prove a server wasn't compromised. For a definitive answer, check the version on the server itself or ask your host.

What Should Website Owners Do?

1. Check your PHP version — hosting panel, Site Health, or php -v on the server.
2. Update immediately to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or newer. If you're on PHP 8.1 or older, migrate to a supported branch or get written confirmation of a vendor backport.
3. Restart the PHP runtime after updating (PHP-FPM, Apache/mod_php or your web server) so the patched binary is actually serving requests.
4. On managed hosting? Ask your provider explicitly whether the PHP2Shell fixes are deployed — don't assume.
5. Audit for compromise if you were unpatched while public exploits circulated: look for unexpected admin users, modified files, or PHP workers spawning shells or downloads.
6. Treat WAFs as a bridge, not a fix. Cloudflare and Vercel's rules reduce exposure to known exploit patterns, but patching is the only complete remediation — there is no configuration-only workaround.

The Bottom Line

PHP2Shell is a reminder that website security doesn't stop at plugins and themes — even a fully updated WordPress site was exposed, because the flaw sat underneath it in PHP itself. The silver lining: the same AI capability that surfaced the bugs also got them patched fast.

Check your PHP version with the AskZyro PHP Security Scanner, confirm your host's patch status, and update now — before today's clumsy public exploits become competent ones. You can also browse our growing collection of free online tools for website owners and developers.

Sources

• The PHP Foundation — security release notes
• CISA — Critical vulnerabilities in PHP require immediate patching
• Vercel — PHP2Shell security bulletin
• AWS Security Blog — exploitation seen before disclosure
• Wiz Research — how AI uncovered PHP2Shell
• Sophos — PoC analysis and Potassium payload
• SecurityWeek — exploitation started days before patches
• BBC — how AI discovered the internet's massive cyber-security risk
• CNBC — what is PHP2Shell and is your data at risk
• W3Techs — PHP usage statistics
• StatusGator — 213 services posted PHP-related status notices
• NOS — Dutch government and education websites taken offline
• Cloudflare — PHP vulnerabilities and WAF protection
• Check Point — PHP2Shell impact across Europe
• NSA — critical patches recommended for PHP vulnerabilities
• NHS England — cyber alert CC-4875
• UK NCSC — critical security issue affecting PHP