PHP2Shell Explained: The Critical PHP Flaws and How to Patch Them

Photo: Victor Grigas, "Wikimedia Foundation Servers-8055 35.jpg", Wikimedia Commons, CC BY-SA 3.0

"The internet will implode in about 12 hours from now btw." That one-line post on X pulled in more than 800,000 views overnight. The internet did not implode. But the panic was about something real: two critical flaws in PHP, the language behind a huge share of the world's websites.

Key points

2 critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619
9.2 out of 10: CVSS v4.0 score for each
4 fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35
69.3%: share of websites (with a known server language) using PHP, per W3Techs
40,741: X posts mentioning PHP2Shell since October 20 (as of October 22, 10:51 AM Riyadh time)

What happened

On October 21, 2026, the PHP project shipped emergency security releases fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed "PHP2Shell." According to the official PHP advisory, both can allow unauthenticated remote code execution: an attacker who never logs in could run their own code on a web server.

The PHP team had given a day's warning on October 20 that a critical release was coming, with both bugs rated CVSS v4.0 9.2. PHP says the risk is highest for Apache with mod_php, where a demonstrated exploit can trigger before any application code runs.

Governments moved fast. CISA urged organizations to patch immediately, and to take systems offline if they cannot. The NSA said the risks are "serious enough to require immediate patching across United States Government departments and agencies." The UK's NCSC and Singapore's CSA issued alerts too, and AP News reported that some government websites in Europe and the U.S. went offline temporarily while they updated.

The numbers: why this is a big deal

PHP is used by 69.3% of all websites whose server-side language is known, according to W3Techs (October 22, 2026). That includes the many sites built on WordPress, Drupal and Joomla. BleepingComputer reported that Cloudflare was already seeing early attacks before the patches landed, and the NHS England cyber team says exploitation in the future is "highly likely."

Who is affected

Per PHP.net, the risk covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. NHS England lists every version before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as affected. PHP 8.1 and older are also affected but no longer receive official updates.

How X reacted

Mentions of "PHP2Shell" on X went from 2 posts in one hour on the evening of October 20 to a peak of 3,005 posts per hour around the patch release on October 21. That adds up to more than 40,000 posts in about a day and a half (X post counts, checked October 22, 10:51 AM Riyadh time, UTC+3).

The tone ranged from dread to dark comedy:

@ns123abc: "the internet will implode in about 12 hours from now btw" (8,557 likes, 801,346 views)
@k_firsov, the night before the patch: "php2shell Tomorrow is a helluva day." (14,851 likes, 3,309,837 views)
@censysio: "Censys observes ~2.58M exposed hosts and ~54.9M web properties running PHP. Exposure does not confirm vulnerability." (51 likes, 5,634 views)

Are you affected? What to do now

Check your version. On your server, run php -v. If your hosting panel shows a PHP version, check it there.
Update. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). On Linux, check your distribution for updated packages; PHP says vendors received the patches in advance.
Restart PHP. Restart PHP-FPM or web server workers, and rebuild containers so the new version actually runs.
On PHP 8.1 or older? Upgrade to a supported version, or ask your vendor about backported fixes.
Using shared hosting or WordPress? Contact your host and ask whether its PHP has been updated to a fixed release.
Can't patch yet? CISA and the NSA say to consider taking the system offline. PHP's temporary measures reduce risk but do not make a server safe.

Why it matters

PHP powers most of the web, including WordPress, Drupal and Joomla sites, so a flaw that lets an attacker run code without logging in puts millions of servers at risk. The doomsday posts were exaggerated, but the danger to unpatched sites is real. If you run a website, check your PHP version today and update or ask your host to.

FAQ

What is PHP2Shell?

The nickname for CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws that can allow unauthenticated remote code execution.

Is my website at risk?

If it runs PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and serves web requests, yes. Check with your host.

Did the internet actually break?

No. Some sites went offline on purpose while patching, but the doomsday posts were exaggerated.

Is there a workaround?

PHP says updating is the only complete fix.

Search This Blog