PHP2Shell: Two Critical PHP Vulnerabilities Put Business Websites at Risk in 2026

Two Critical PHP Vulnerabilities Are Raising Cybersecurity Concerns Worldwide

On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities. Both could let attackers execute malicious code on vulnerable web servers without logging in first.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell.

Both carry a critical CVSS v4.0 severity score of 9.2 out of 10.

The discovery has attracted significant attention because PHP is one of the most widely used programming languages for websites and web applications. Businesses in nearly every industry rely on PHP to run websites, customer portals, online stores, and internal applications.

Most website vulnerabilities are limited to one plugin or software product. PHP2Shell is different: it affects the underlying PHP runtime that many different applications depend on. That makes it especially important for organizations that may not realize how widely PHP is used in their technology environments.

The U.S. National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have both issued urgent guidance recommending that organizations inventory their PHP systems and patch immediately.

For business owners and IT teams, the message is clear: PHP2Shell requires prompt investigation and patching, even if a website appears to be operating normally.

1. What Is PHP, and Why Is It So Widely Used?

PHP, short for PHP: Hypertext Preprocessor, is an open-source programming language used mainly to build dynamic websites and web applications.

When someone visits a PHP-powered website, the web server runs PHP code to generate content, retrieve information from databases, authenticate users, and perform other functions.

PHP supports many familiar platforms and business applications, including:

• WordPress websites
• WooCommerce online stores
• Drupal and Joomla content management systems
• Magento-based e-commerce platforms
• Laravel applications
• Custom customer and employee portals
• Internal business applications

Because PHP runs on the server, flaws in its runtime can create security risks that ordinary website visitors never see. A company may have a modern website with updated themes and plugins while still running an outdated PHP version underneath.

This is why website cybersecurity involves more than updating the content management system. Organizations must also maintain the underlying software, hosting environment, and supporting infrastructure.

Does PHP Really Power 70% of the Internet?

Headlines describing 70% of the internet as being at risk can be misleading.

PHP does have a very large share of websites whose server-side language can be identified. However, that statistic doesn’t mean 70% of all websites have been compromised, or that they’re all running an affected, unpatched configuration.

Actual exposure depends on the PHP versions in use, whether security fixes have been applied, and the specific hosting environments involved. The real concern is that PHP’s widespread use creates a potentially large number of systems that need urgent attention.

2. What Are the Two PHP2Shell Vulnerabilities?

PHP2Shell refers to two critical security flaws in PHP’s core request-handling and memory-management functionality. Both may allow an unauthenticated attacker to execute code on an affected server.

In simpler terms, an attacker may be able to send a specially crafted request to a vulnerable website and make the server perform actions the attacker should never be allowed to perform.

CVE-2026-109618: Remote Code Execution Through Memory Corruption

The first vulnerability involves how PHP handles certain out-of-memory conditions while processing and cleaning up requests.

Under specific circumstances, PHP can be left with partially initialized internal data and then handle that data incorrectly. An attacker may be able to exploit this behavior to corrupt memory and execute malicious code.

CVE-2026-109619: Remote Code Execution Through Stale Internal State

The second vulnerability involves internal request information that can remain accessible after the memory supporting it has been released.

This creates a use-after-free condition, which an attacker can potentially exploit to access sensitive memory or execute unauthorized code.

Why Are These Vulnerabilities Considered Critical?

The most concerning characteristic is that successful exploitation may not require valid login credentials.

Attackers may be able to target exposed PHP services remotely, potentially gaining code execution with the privileges of the web server process. The impact depends on the server’s permissions, configuration, and surrounding security controls.

Potential consequences include:

• Unauthorized access to website files
• Exposure of sensitive business or customer information
• Website defacement or malicious redirects
• Installation of malware
• Disruption of online services
• Unauthorized access to connected applications or databases
• Attempts to move into other parts of the organization’s network

These are potential consequences of successful exploitation, not evidence that every vulnerable server has already experienced them.

3. Why PHP2Shell Is Different From an Ordinary Website Vulnerability

Many website security incidents involve weaknesses in plugins, themes, extensions, or custom application code. PHP2Shell is different because the vulnerabilities exist in PHP itself.

That means updating a WordPress plugin or changing a website password doesn’t fix the underlying problem. Even a well-maintained application may remain exposed if it runs on an affected PHP runtime.

The PHP security team has identified several web-serving environments as potentially affected, including:

• PHP-FPM
• Apache with mod_php
• php-cgi
• FrankenPHP
• LiteSpeed

The PHP project has highlighted Apache mod_php as particularly concerning. Exploitation has been demonstrated in cases where a malicious request triggers the issue before normal application code even runs. This makes it especially important for businesses to identify which PHP version their hosting infrastructure is actually running.

The central lesson is that application security and server security must work together. A secure website requires both properly maintained applications and a properly secured runtime environment.

4. Which PHP Versions Are Affected?

On October 21, 2026, the PHP development team released fixed versions for its supported release branches, as detailed in the official PHP security advisory. CISA’s alert directs organizations to update to these same releases.

Organizations should verify that their systems have been updated to a fixed release or to a vendor-provided package containing the relevant security patches.

PHP Branch	Security-Fixed Version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Earlier releases in these branches need the corresponding security update.

Older PHP branches, including PHP 8.1 and earlier, no longer receive regular PHP releases. The PHP project published limited source backports for versions 7.4 through 8.1, and some operating system distributions and long-term-support vendors may offer patched packages for older versions. Organizations using these versions should confirm with their vendor that a verified fix is installed, and plan a migration to a supported release.

Keep in mind that a distribution-provided package may include a security backport without showing the same upstream version number. IT teams should check the vendor’s advisory and package status rather than relying on the version string alone.

What About WordPress Websites?

WordPress relies on PHP, so WordPress websites running on affected PHP installations may be exposed.

However, using WordPress doesn’t automatically mean a website is vulnerable. What matters is the underlying PHP runtime, the security updates the hosting provider has applied, and the server configuration.

WordPress core, themes, and plugins should still be kept up to date, but those updates don’t replace the PHP2Shell security fix. Businesses using managed WordPress hosting should contact their provider to confirm the underlying PHP environment has been patched.

5. Why These Vulnerabilities Matter to Businesses

For many organizations, a website is more than a marketing platform. It may be essential to customer communication, lead generation, online sales, document sharing, or service delivery. A compromised web server can therefore have real operational and financial consequences.

Website Downtime and Business Disruption

If a website or customer portal goes down, a business may lose the ability to process orders, receive inquiries, or provide online services. Even a temporary disruption can affect customer experience and internal workflows.

Sensitive Data Exposure

Some PHP applications connect to databases containing customer records, account information, transaction histories, or other sensitive data. A server compromise may expose any information the affected application or its service account can reach.

Reputational Damage

Customers expect businesses to protect the systems and information they rely on. A public website compromise, malicious redirect, or data exposure can damage customer confidence.

Increased Recovery Costs

Responding to a compromised web server may require forensic investigation, malware removal, credential rotation, system rebuilding, data restoration, and additional monitoring. Recovery can cost far more than identifying and patching the vulnerability before it’s exploited.

Risks Beyond the Public Website

PHP is also used in internal applications, administration tools, vendor portals, and specialized business systems, which are easy to overlook during routine website maintenance. Organizations should evaluate every PHP-dependent service, not only their main public website.

6. What Should Businesses Do Immediately?

The most effective response starts with understanding where PHP is used and which systems need attention.

The NSA, CISA, and the PHP security team have all emphasized prompt patching, because temporary mitigations don’t provide the same protection as the security fixes.

Step 1: Identify Every PHP-Based System

Start by creating an inventory of websites, web applications, servers, containers, and third-party products that use PHP. Include:

• Public company websites
• WordPress and e-commerce installations
• Customer and employee portals
• Internal web applications
• Cloud-hosted applications
• Development and staging environments
• Vendor-managed software that embeds PHP

Don’t assume every PHP installation is visible from the website’s admin dashboard. As CISA notes, PHP is often a component of other software, so its presence may not be directly visible. Some applications bundle their own PHP runtime, which must be updated separately.

Step 2: Verify the PHP Version and Patch Status

Ask your hosting provider, IT administrator, or application vendor to confirm which PHP version you’re running and whether the PHP2Shell fixes have been installed.

For supported upstream PHP releases, the fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For vendor-managed or distribution-packaged PHP, confirm that the relevant CVE fixes are included.

Step 3: Apply Security Updates Promptly

Prioritize internet-facing PHP services, since remote attackers can reach them directly. Coordinate patching with the appropriate administrator or hosting provider.

Before making changes, follow your organization’s backup and change-management procedures. After the update, confirm that the website and business applications work correctly.

Step 4: Review Security Logs and Alerts

IT teams should review available web server, application, endpoint, and security monitoring logs for suspicious activity. Possible indicators include unexpected requests, unusual process execution, unauthorized file changes, or suspicious outbound connections.

CISA recommends monitoring for suspicious activity, including PHP worker processes that launch shells or download tools. Because exploit techniques and detection guidance evolve, check current advisories from CISA and the NSA rather than relying on a single static list of indicators.

Step 5: Assess Systems That Cannot Be Patched Immediately

If an affected system can’t be patched promptly, evaluate temporary risk-reduction measures and consult the official PHP advisory.

The NSA recommends taking a system offline until it can be fully mitigated if an immediate update isn’t feasible. CISA gives the same advice for systems that can’t be updated right away or that still run PHP 8.1 or earlier unsupported versions, and notes that a web application firewall may offer some protection until systems are patched.

Temporary mitigations may reduce exposure, but PHP’s security guidance is clear that there’s no complete substitute for updating.

Need CMMC & DOW Compliance Documentation?

Stop searching across multiple sources for the guidance you need. Access CMMC resources, DOW compliance documentation, DFARS information, SSP guidance, POA&M resources, and assessment materials in one place.

Download the CMMC & DOW Compliance Documentation PDF to help support your cybersecurity and compliance program.

Step 6: Verify the Environment After Patching

After updates are installed, confirm that:

• The expected security-fixed PHP package is active
• Web applications operate normally
• Relevant web-serving processes have been restarted or replaced as required
• Bundled PHP runtimes have been reviewed
• Security monitoring remains operational
• There are no unresolved signs of compromise

Patching closes the known vulnerability, but it doesn’t remove malware or reverse unauthorized changes if a system was already compromised.

7. Why Patch Management Is Essential to Website Cybersecurity

PHP2Shell shows how quickly a newly disclosed vulnerability can become a business-wide security concern.

Organizations often run multiple websites and applications across different hosting platforms, service providers, and software environments. Without an accurate inventory, it’s hard to tell which systems are affected when an urgent advisory comes out. This is where structured patch management becomes essential.

An effective process should identify software dependencies, monitor vendor advisories and CISA’s Known Exploited Vulnerabilities (KEV) Catalog, evaluate vulnerability severity, prioritize critical systems, coordinate updates, and verify successful remediation. NIST’s SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning, offers a federal framework for building that process.

For businesses without a dedicated internal cybersecurity team, maintaining this process can be challenging. Managed IT services can improve visibility into your infrastructure, coordinate security updates, and reduce the chance that critical vulnerabilities go unaddressed.

Explore Brea Networks’ Managed IT Services to learn more about ongoing IT management and cybersecurity support.

8. Could PHP2Shell Affect More Than a Website?

Yes. Depending on the environment, a compromised web server can become a starting point for further malicious activity.

For example, an attacker who gains code execution through a vulnerable PHP service may try to access files, application credentials, connected databases, or other reachable systems. How far they can get depends on how the application is configured and how much access its service account has. That’s why a web server should never be treated as an isolated piece of technology.

Additional Security Measures That Reduce Business Risk

Beyond patching, businesses should consider:

• Limiting web server account privileges
• Separating public-facing services from sensitive internal systems
• Restricting unnecessary network connections
• Protecting administrative credentials
• Using multifactor authentication for management interfaces
• Maintaining protected backups
• Monitoring for suspicious server activity
• Developing incident response procedures

These practices don’t replace the PHP security update. They reduce the potential impact of other vulnerabilities and limit what an attacker can reach after an initial compromise.

9. Building a Long-Term Strategy Against Critical Software Vulnerabilities

Emergency security updates are an unavoidable part of managing modern technology. New vulnerabilities will keep appearing in programming languages, operating systems, business applications, network equipment, and cloud services.

The goal isn’t to predict every future vulnerability. It’s to build an environment where critical risks can be identified and addressed quickly.

Maintain an Accurate Technology Inventory

Know which applications, servers, software versions, and service providers support your operations.

Establish Clear Security Responsibilities

Decide who is responsible for monitoring advisories, approving updates, applying patches, and confirming successful remediation.

Prioritize Internet-Facing Systems

Publicly accessible services deserve particular attention because attackers can reach them directly. Eligible organizations, including many critical infrastructure businesses, can request free vulnerability scanning of internet-facing systems through CISA’s Cyber Hygiene Services.

Review Third-Party Hosting and Support Arrangements

Understand which security responsibilities belong to your hosting provider and which remain with your business.

Prepare for Security Incidents

An incident response plan should explain how suspicious activity will be investigated, who must be contacted, and how affected systems will be contained and restored. NIST’s SP 800-61 Rev. 3 provides current federal guidance on incident response.

Continuously Improve Cybersecurity

Routine reviews, vulnerability management, employee awareness, and recovery testing help organizations respond more effectively when new threats emerge.

PHP2Shell is a reminder that cybersecurity depends on preparation, visibility, and timely action, not just reacting after an attack occurs.

PHP2Shell Security Checklist for Businesses

Use this checklist to identify immediate priorities.

Identify Exposure

• [ ] Inventory websites and applications that use PHP.
• [ ] Identify internet-facing PHP servers and services.
• [ ] Review vendor-managed and bundled PHP environments.
• [ ] Confirm which hosting providers manage PHP updates.

Apply Security Updates

• [ ] Check PHP versions against the official security advisory.
• [ ] Install the appropriate fixed release or verified vendor patch.
• [ ] Review unsupported PHP versions and plan upgrades.
• [ ] Confirm web applications function correctly after patching.

Investigate and Monitor

• [ ] Review available logs for suspicious activity.
• [ ] Check security alerts and endpoint detections.
• [ ] Investigate unexpected server processes or file changes.
• [ ] Escalate suspected compromise to the appropriate security team.

Strengthen Long-Term Protection

• [ ] Review administrative privileges and remote access.
• [ ] Maintain tested backups of critical applications and data.
• [ ] Establish a documented vulnerability management process.
• [ ] Review incident response and recovery procedures.
• [ ] Assign responsibility for monitoring future security advisories.

This checklist is a starting point. Follow current PHP and vendor-specific guidance for your actual environment.

Official Resources

• NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
• CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching
• NIST National Vulnerability Database: CVE-2026-109618
• NIST National Vulnerability Database: CVE-2026-109619
• CISA Known Exploited Vulnerabilities Catalog
• NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning
• NIST SP 800-61 Rev. 3: Incident Response Recommendations
• CISA Cyber Hygiene Services
• PHP Security Advisory (php.net)

Frequently Asked Questions About PHP2Shell

1. What is PHP2Shell?

PHP2Shell is the collective name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Both can potentially allow unauthenticated remote code execution on affected PHP web-serving environments.

2. How serious are the PHP2Shell vulnerabilities?

Both received critical CVSS v4.0 scores of 9.2 out of 10. They’re particularly concerning because exploitation may not require valid user credentials.

3. Are all WordPress websites affected?

No. WordPress websites running vulnerable PHP versions may be exposed, but sites with the relevant PHP security fixes aren’t vulnerable to these flaws just because they use WordPress.

4. Which PHP versions fix PHP2Shell?

The PHP project released security fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. These are the same versions listed in CISA’s alert. Some operating system vendors may also provide verified backported fixes.

5. Can attackers exploit PHP2Shell without a password?

Yes. Under affected conditions, the vulnerabilities may allow unauthenticated remote code execution, so an attacker doesn’t necessarily need valid login credentials.

6. Is PHP2Shell being actively exploited?

When CISA published its alert, it said it had not observed exploitation. That alert is separate from CISA’s Known Exploited Vulnerabilities Catalog, which didn’t list either CVE at the time. Private security researchers have reported attacks, however. Amazon Threat Intelligence says its honeypot network recorded an exploitation attempt on October 17, 2026, four days before public disclosure, and watchTowr reports observing in-the-wild exploitation of both vulnerabilities. Check the KEV Catalog for the latest status.

7. Does updating WordPress fix PHP2Shell?

Not by itself. PHP2Shell affects the PHP runtime, so businesses must confirm that the underlying PHP installation has received the security fix.

8. What should businesses do if their hosting provider manages PHP?

Contact the provider and ask them to confirm that the PHP2Shell patches have been applied, and whether any additional action is needed for your websites or applications.

9. What if a business is using an unsupported PHP version?

Review your operating system or support vendor’s security guidance, apply any verified backport that’s available, and plan a migration to a supported PHP release.

10. Does patching guarantee that a website has not been compromised?

No. Patching closes the known vulnerabilities, but it doesn’t prove an attacker never accessed the system. If you see signs of compromise, investigate and follow your incident response procedures.

11. How can managed IT services help protect against future vulnerabilities?

Managed IT services can support software inventory, patch management, security monitoring, backup planning, and incident response preparation, helping businesses maintain a more consistent cybersecurity program.

Conclusion: PHP2Shell Is a Reminder That Cybersecurity Cannot Wait

The discovery of two critical PHP vulnerabilities in October 2026 shows how important it is to keep technology environments secure and up to date.

PHP supports a substantial portion of the web, which makes flaws in its core runtime especially significant for businesses that depend on websites and online applications. PHP’s widespread use doesn’t mean every website has been compromised, but organizations running affected versions should treat these updates as an immediate priority.

The most important steps are straightforward: identify affected systems, apply verified patches, review available security evidence, and strengthen ongoing vulnerability management.

Website security also extends beyond themes, plugins, and passwords. Protecting the underlying server infrastructure is essential to protecting the applications and information that depend on it.

Protect Your Business With Brea Networks

At Brea Networks, we understand that cybersecurity threats can disrupt operations, expose sensitive information, and create costly recovery challenges.

Our team helps organizations manage IT infrastructure, improve cybersecurity practices, and build practical strategies for reducing technology risk. Whether your business needs help with patch management, network security, endpoint protection, or ongoing IT support, a proactive approach can make a meaningful difference.

Learn more about our Managed IT Services or contact Brea Networks to discuss your business’s cybersecurity needs.

Stay informed. Keep your systems updated. Protect what matters.

Schedule a free consultation with the Brea Networks team to review your current environment, identify compliance risks, and understand what steps are required to move forward. A short conversation can help you avoid costly mistakes and focus on what matters for contract eligibility and security.

About Brea Networks

Brea Networks is a cybersecurity and compliance-focused IT partner dedicated to supporting Defense Industrial Base (DIB) contractors. We help organizations understand and implement the security requirements outlined in FAR 52.204-21, DFARS 252.204-7012, and the CMMC framework from Level 1 self-assessments to Level 2 and Level 3 readiness. Our team works alongside contractors to strengthen system security, define assessment scope, prepare documentation such as System Security Plans (SSPs) and POA&Ms, and build sustainable cybersecurity programs that protect FCI and CUI. Whether you are preparing for a self-assessment or simply improving your security posture. Brea Networks provides practical guidance and technical expertise to help you move forward with confidence.

Brea Networks, LLC
471 W Lambert Rd Ste 105
Brea, CA 92821

https://www.cmmccompliance.us
https://www.breanetworks.com

Telephone: 714-592-0063