Two critical security vulnerabilities in PHP, known as PHP2Shell, have raised security concerns since they were made public on October 21, 2026.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow attackers to run harmful code on affected servers without a username or password. Both have a critical security score of 9.2 out of 10.

Security experts have reported many attack attempts, and some successful attacks have also been confirmed. This makes PHP2Shell an important issue for businesses using PHP-based websites, applications, and network systems.

This article explains what PHP2Shell is, which systems may be affected, how serious the attacks are, and what businesses should do to protect their systems.

Sources: NCSC-NL – PHP2Shell Security Tracking | Red Hat – PHP2Shell Security Bulletin

1. What Is PHP2Shell?

PHP is a popular programming language used to build websites and web applications. Many well-known platforms, including WordPress, Drupal, and Joomla, use PHP.

PHP2Shell is the name given to two serious security vulnerabilities found in PHP.

  • CVE-2026-109618: This vulnerability is related to how PHP manages memory when a server runs out of available memory. Under certain conditions, an attacker may use this problem to run harmful code.
  • CVE-2026-109619: This vulnerability happens when PHP continues to use memory information that should no longer be available. Attackers may use this problem to run commands on an affected server.

Both vulnerabilities can lead to Remote Code Execution (RCE).

RCE means that an attacker can run code on a server from another location. In the case of PHP2Shell, an attacker may be able to do this without logging in.

If an attack is successful, the attacker may be able to access sensitive information, install harmful software, or affect how the server works. The actual damage depends on the server's settings and the attacker's access level.

One important point is that PHP2Shell affects PHP itself, not just a specific website or plugin. Therefore, updating WordPress or other website software alone may not fix the problem.

Sources: Red Hat – PHP2Shell Technical Information | Wiz Research – PHP2Shell Analysis

2. Which Systems Are Affected?

PHP2Shell may affect many types of systems that use vulnerable PHP versions.

These include:

  • Websites and web applications: Company websites, online stores, customer portals, and other PHP-based services.
  • Content Management Systems (CMS): Websites built with WordPress, Drupal, Joomla, and similar platforms.
  • Internal business systems: CRM systems, company management tools, and custom business applications.
  • Network devices: Some firewalls, routers, and other network products that use PHP.

Businesses should not only check their websites. They should also review internal systems and software provided by other companies.

Affected PHP Versions

The PHP team released security updates on October 21, 2026, to fix the two main PHP2Shell vulnerabilities.

PHP Version

Recommended Action

PHP 8.5

Update to 8.5.12

PHP 8.4

Update to 8.4.27

PHP 8.3

Update to 8.3.36

PHP 8.2

Update to 8.2.35

PHP 7.4, 8.0, 8.1

Upgrade or use a verified security fix from your system provider

PHP 7.3 and older

Upgrade to a supported PHP version

Older PHP versions no longer receive official security updates from the PHP team. However, some operating system providers may offer their own security fixes.

Businesses should check with their hosting providers or IT teams to confirm whether their systems are protected.

Sources: Plesk – PHP2Shell Security Advisory | AWS – PHP2Shell Security Guidance

3. PHP2Shell: Key Events and Recent Updates

Since PHP2Shell became public, security companies and government agencies have been watching the situation closely.

Here are some important developments.

October 21: PHP Releases Security Updates

The PHP team made the vulnerabilities public and released security patches for supported PHP versions.

Security companies also started warning businesses to update their systems as soon as possible.

October 23: Another PHP Security Issue Is Reported

The PHP team reported another vulnerability, CVE-2026-115560, related to PHP's session upload progress feature.

According to AWS, this issue was not fixed by the PHP2Shell updates released on October 21.

Businesses should check for additional security updates rather than assuming that one update fixes every related problem.

October 27: Wiz Reports Attack Attempts

Wiz Research published a report about PHP2Shell attack attempts.

The company found that attackers were trying different ways to use the vulnerabilities. However, Wiz had not seen a complete successful attack in its own data at that time.

Researchers also warned that successful attacks were still possible under certain conditions.

November 3: Active Attacks Against Network Devices

The Cyber Security Agency of Singapore (CSA) published a warning about active attacks involving PHP2Shell.

According to the agency, attackers had targeted vulnerable Palo Alto Networks firewalls with management interfaces open to the Internet.

The report also described how attackers could combine PHP2Shell with another security vulnerability to gain greater control over affected systems.

This shows that PHP2Shell is not only a website security issue. It can also create risks for important network devices used by businesses.

Sources: Wiz Research – PHP2Shell Exploitation Report | CSA Singapore – PHP2Shell Security Alert

4. Scale of Attack Attempts and Global Exposure

PHP2Shell has received attention because PHP is widely used and many systems may be affected.

However, it is important to understand the difference between attack attempts, successful attacks, and vulnerable systems.

Scale of Attack Attempts

Security researchers have reported many attempts to use PHP2Shell.

Some attackers scan the Internet to find vulnerable servers. Others try to run harmful code after finding a possible target.

However, not every attempt is successful.

According to Wiz Research's report on October 27, many attacks failed because successful exploitation depends on several technical conditions, such as PHP settings, memory use, and server configuration.

At the time of that report, Wiz had not confirmed a complete successful attack in its own data.

This does not mean that all systems were safe. Later reports showed active exploitation against certain network devices.

Global Exposure Scale

Another important question is how many systems around the world may still be vulnerable.

Wiz Research reported that, about one week after PHP2Shell became public:

  • The number of vulnerable machines exposed to the Internet each day had fallen by about 67% in its data.
  • The number of organizations with at least one exposed vulnerable system had fallen by about 47.9% in its monitored group.

These numbers suggest that many organizations acted quickly to fix the problem.

However, the results only represent the systems monitored by Wiz. They do not show the exact number of vulnerable systems worldwide.

Exposure Beyond Websites

The Netherlands' National Cyber Security Centre (NCSC-NL) also tracks software products that may be affected by PHP2Shell.

As of November 2, 2026, its tracking list included:

  • 930 products being tracked
  • 215 products confirmed as vulnerable
  • 167 products with available fixes

These figures show that PHP2Shell may affect many types of software and devices, not only websites.

They also show why businesses should check their full technology systems, including software and devices provided by third-party vendors.

Sources: Wiz Research – Attack Attempts and Exposure Trends | NCSC-NL – PHP2Shell Product Tracking

5. What Are the Risks for Businesses?

The impact of PHP2Shell depends on the affected system and whether an attacker can successfully use the vulnerability.

Businesses should pay attention to four main risks.

Unauthorized Access

Attackers may be able to run commands on vulnerable servers without permission.

This could give them access to applications or other connected systems, depending on the server's security settings.

Sensitive Data Exposure

A successful attack may allow attackers to access information stored or processed by affected systems.

This could include business data, system settings, or login information.

Business Service Disruption

Attackers may cause websites or applications to stop working properly.

For businesses that depend on online services, this could affect daily operations and customer experience.

Network Security Risks

Some network devices also use PHP.

If an attacker gains control of a vulnerable device, the risk may extend to other connected systems.

The recent reports involving firewalls show why businesses need to check more than just their websites.

Sources: Red Hat – Security Bulletin | CSA Singapore – Security Alert

6. What Should Businesses Do Now?

Businesses should act quickly to check their systems and apply the necessary security updates.

Step 1: Check Which Systems Use PHP

Make a list of websites, applications, internal systems, and network devices that may use PHP.

Start with systems that can be accessed from the Internet, as these may be easier for attackers to reach.

If you are not sure which systems use PHP, ask your IT team, website developer, or hosting provider.

Step 2: Update PHP

Check the PHP version used by each system.

Install the latest security update for your supported PHP version, or use a verified security fix from your system provider.

If your PHP version is no longer supported, plan to upgrade to a supported version.

Step 3: Restart PHP Services

After installing the update, restart or reload the relevant PHP services.

This step is important because some older PHP processes may continue running even after the update has been installed.

Your IT team should confirm that the updated PHP version is actually running.

Step 4: Check for Signs of Attacks

Updating PHP can stop future attacks using the fixed vulnerabilities, but it does not remove damage from earlier attacks.

IT teams should review server logs and look for unusual activities, such as:

  • Unknown files appearing on the server
  • Unexpected commands or programs running
  • Unusual connections to outside servers
  • Changes to important system settings

If suspicious activity is found, the business should investigate before returning the affected system to normal use.

Step 5: Review Passwords and Access

If a system may have been compromised, check whether passwords, API keys, or other sensitive information could have been exposed.

Change affected credentials when necessary and review who has access to important systems.

Step 6: Use Temporary Protection if Updates Are Not Available

If a system cannot be updated immediately, businesses should consider limiting access from the Internet or using additional network security controls.

A Web Application Firewall (WAF) may help block some harmful requests.

However, temporary protection does not replace security updates.

Source: AWS Security Blog – PHP2Shell Protection and Mitigation

7. Additional Notes for IT Teams

For technical teams, there are a few more points to consider.

PHP server configuration: PHP can run in different ways, including PHP-FPM, Apache mod_php, and php-cgi. The level of risk may be different depending on the configuration. Apache mod_php has been identified as a particularly high-risk setup.

Temporary security settings: Some security reports suggest changing PHP settings to reduce the chance of an attack. However, these changes may not fully protect the system and should be tested carefully.

Third-party software: Some software products and network devices include PHP inside their systems. IT teams should check security updates from the product manufacturers.

Security monitoring: Even after updating PHP, businesses should continue checking logs and watching for unusual activity. This is important because a system may have been attacked before the security patch was installed.

Sources: NCSC-NL – PHP2Shell Tracking | Red Hat – PHP2Shell Security Information

8. Key Takeaways: Why PHP2Shell Matters

PHP2Shell shows how a security problem in widely used software can affect many businesses at the same time.

Although security patches are available, businesses still need to make sure that every affected system has been checked and updated correctly.

The recent reports of active attacks also show that waiting for a visible security incident is not a safe approach.

To reduce security risks, businesses should regularly review their systems, install security updates, monitor unusual activity, and follow information from trusted security sources.

Most importantly, cybersecurity should be part of regular IT management, not something businesses only think about after an attack happens.

Keeping systems updated and having a clear plan for handling security problems can help businesses protect their data, maintain stable operations, and reduce future risks.