In October 2026, security researchers disclosed two critical flaws in PHP, a programming language that powers a vast portion of the internet. This isn't just a problem for tech giants; it affects anyone with a website.
What is the ‘PHP2Shell’ Flaw?
Collectively nicknamed ‘PHP2Shell’,
the two vulnerabilities (tracked as CVE-2026-109618 and CVE-2026-109619) are flaws within the core PHP language itself, not in an application like WordPress. This makes them particularly dangerous. They allow for 'remote code execution', which means an attacker could potentially run their own malicious code on a web server without needing a password or any prior access. Both vulnerabilities were rated 'Critical' with a score of 9.2 out of 10, and government agencies like the US Cybersecurity and Infrastructure Security Agency (CISA) have issued alerts urging immediate action.
A Pillar of the Modern Web
To understand the scale of this problem, you need to know what PHP is. It is a server-side scripting language that's been a foundational part of the web for decades. As of late 2026, PHP was used by an estimated 69-79% of all websites where the server language is known. This includes huge platforms like WordPress, which itself powers around 43% of the entire internet. When a flaw is discovered in something so ubiquitous, the potential attack surface is massive, affecting millions of websites, from small business pages to large e-commerce platforms and government portals.
Who is at Risk?
The vulnerabilities affect a wide range of PHP versions, including unsupported older versions that many websites still use. The security patches released by the PHP team officially cover versions 8.2, 8.3, 8.4 and 8.5. However, websites running on older versions, like 8.1 and earlier, will not receive official updates from the PHP project, leaving them exposed unless they get support from a thirdparty vendor or upgrade. Any organization running a website on a PHPbased platform—including common configurations like Apache with mod_php or PHPFPM—was advised to investigate immediately.
What Can Attackers Do?
A successful exploit of the PHP2Shell flaws could have severe consequences. Attackers could take control of a web server, steal or expose sensitive data like customer information and business records, deface a website, or use the compromised server to launch further attacks. For a small business, this could lead to operational disruption, financial loss, and significant reputational damage. Because the flaw exists in the PHP runtime, security researchers warned that attacks could occur before a website's own applicationlevel security has a chance to intervene.
What You Must Do Now
The advice from security experts is unanimous and urgent : patch immediately . Website owners and administrators should identify all systems running PHP and update to a patched version . If you use a managed hosting provider , contact them to confirm they have applied the fixes . For those managing their own servers , it's crucial not just to update the software but also to restart the PHP services for the patch to take effect—a step that is easy to miss . For websites on unsupported , older PHP versions , the risk is high . The best course of action is to take the system offline until it can be upgraded to a secure , supported version .
