PHP’s developers released emergency security fixes Oct. 21 for two flaws that could let attackers run commands on vulnerable web servers without logging in.
PHP is a programming language used for everyday website functions, including logins and online forms. It’s also estimated to power 70% of websites around the world. The flaws, now known together as PHP2Shell, are in the software that runs PHP on a server, called the PHP runtime. Updating a website’s content management system, such as WordPress, does not necessarily update PHP itself.
The flaws involve mistakes in how PHP handles computer memory while processing website requests. In one particularly vulnerable setup, an attack can work before the website’s own code even starts running. The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
One of the weaknesses had first surfaced in 2024. The PHP Foundation said a developer had spotted the problem but could not demonstrate an attack, and attempts to fix it stalled over concerns about breaking other software. However, with the help of AI, in August 2026, researcher Ryan Austin at cybersecurity firm Calif demonstrated an attack during an investigation. The PHP project moved the release forward by a day after the two vulnerability identifiers began circulating on online forums and social media Oct. 20.
Attack attempts were detected even before the public announcement. Amazon Threat Intelligence reported one against its decoy servers on Oct. 17, although it could not establish whether the attempt would have succeeded against a real system.
Where PHP can go unnoticed
A company’s main website may be only one place where PHP is installed. Sai Molige, senior manager of threat hunting at Forescout, a cybersecurity company, said the language also runs inside the web-based control panels used to manage storage devices, some firewalls and VPN systems. Businesses using these products may have to wait for their manufacturers to provide security updates.
Molige also pointed to commercial software that comes with its own copy of PHP, containers running older software and websites inherited through company acquisitions. Updating PHP on the main web server would not necessarily fix those other installations.
One example is Plesk, a server management software provider. It confirmed that PHP versions supplied with its software were affected and released updates for both those versions and the PHP engine used by its own management panel.
Joe Connolly, lead of content delivery and security at bunny.net, a content delivery network provider, warned against treating a website update as sufficient.
“The dangerous assumption is that an updated website means an updated PHP runtime,” Connolly said.
Older software adds to the problem
In its “2026 PHP Landscape Report”, Perforce Zend, a PHP software and support provider, found that 40% of surveyed PHP teams were running at least one version that no longer received regular security updates from the PHP project. The survey did not measure how many installations were vulnerable to PHP2Shell.
For these flaws, PHP published limited fixes for some older versions, but businesses may still need patched packages from their software suppliers.
The Netherlands’ National Cyber Security Centre is keeping a list of products that may contain affected PHP software. As of Oct. 23, some products were still under investigation, while others had received fixes from their suppliers.
Even checking for signs of an attack may not give companies a clear answer. Rapid7, a cybersecurity company, warned in its technical analysis that hiding PHP error messages does not prevent exploitation, and that clean logs do not prove an installation was safe.
Samuel Hassine, CEO and co-founder of Filigran, a cybersecurity software company, said businesses also need to check whether anyone accessed their systems before the fixes were installed.
“Patching is the easy part. Knowing what you run is the real test,” Hassine said.