PHP2Shell: the critical PHP flaw explained (and what it means for your website)

What exactly happened?

It concerns two vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619, together called 'PHP2Shell'. Both allow remote code execution: an attacker can run code on the server from the outside, without an account, with the rights of the web process. One of the two can also read snippets of PHP's working memory.

The key thing to grasp: the flaws are not in a plugin, theme or in your own code, but in the PHP runtime, the engine that executes the code. That means a site is vulnerable even if its own code is clean. CVE-2026-109618 revolves around a memory bug: when a request exhausts memory, PHP can be interrupted halfway while internal data is only partly set up, after which the cleanup step treats that broken data as valid.

PHP rates both flaws at a CVSS score of 9.2 (critical); some security firms even leaned towards 10. According to the discoverers, versions from PHP 5.4 through PHP 8 are vulnerable, and an attack works even against a default configuration. Because PHP runs most of the web (roughly 70% of all websites), this potentially hits a huge number of sites at once.

• Two flaws in the PHP runtime: CVE-2026-109618 and CVE-2026-109619
• Unauthenticated remote code execution, plus reading of working memory
• CVSS 9.2 (critical) according to PHP
• Vulnerable from PHP 5.4 through 8, including default configurations
• Sits in the engine, not in your code or plugins

What brought it to light?

Two things made this story unusual. First, how it was found: the flaws were discovered with the help of AI, by researchers from Wiz and OpenAI among others. Automated analysis found a class of bugs that had sat unnoticed in the code for years.

Second, the timing. Normally this goes through 'coordinated disclosure': quietly prepare a patch first, only then release the details. But on Tuesday 20 October the details leaked online ahead of that agreement, before any patch existed. That turned a controlled announcement into a race against the clock: attackers got the knowledge at the same moment as defenders.

PHP responded with emergency patches on Wednesday 21 October. And it did not stay theoretical: security firms saw exploitation attempts early on, partly even before the official release. A honeypot recorded an attempt as early as 17 October, and Cloudflare saw attacks in the early morning of the 21st, before the patch was out.

Why this hits smaller websites too

'Hacking' makes you think of big companies, but this type of flaw hits everyone. Because it sits in the runtime, it does not help that your website code is clean: the moment the server runs PHP, the attack surface is there. On shared hosting, where many sites share the same PHP install, that counts double.

Web shops carry an extra risk on top. Platforms like Magento, Shopware and WooCommerce all run on PHP and are therefore exposed, even if their own code and plugins are fully up to date. The only real protection comes from the hosting side: a patched PHP version.

What to do now

PHP's own message is clear: updating is the only safe fix. Temporary measures (memory limits, WAF rules) close only part of the attack paths.

• Make sure your server runs a patched PHP version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer).
• After the update, restart the PHP-FPM or Apache service, or the old version stays active.
• Check the version actually running (not just what the package manager reports).
• On PHP 8.1 or older (end-of-life)? There's no official release, but often a backported update via your host or distribution: have it applied and plan a move to 8.3 or newer.
• Have your logs checked for suspicious requests around and after 21 October.

And if BRKdesign looks after your website?

This flaw hits exactly the kind of sites we work on daily. We build and manage both modern, largely static websites and WordPress sites, and the latter run heavily on PHP, so staying up to date there is crucial.

For websites we host or manage we keep the PHP version, the WordPress core and the plugins updated, and we track vulnerabilities like this closely, so you don't have to. Not sure whether your site (or your club's or company's) is in good shape? Just ask us and we'll take a look.