PHP2Shell and the 70% of Websites That Run PHP

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, patched on 21 October 2026. On an unpatched server, an attacker with no login can send crafted requests that may let them run their own code or read the server's memory. Exploitation began the day the fixes shipped, and one attempt was seen four days earlier.

It matters because PHP is everywhere. According to W3Techs, PHP runs 69.3% of all websites whose server-side language is known, roughly seven in ten. That does not mean seven in ten websites are vulnerable, but it does mean the flaw sits underneath a very large share of the web: WordPress sites, Laravel apps, online shops and many internal tools.

This guide explains what PHP2Shell is, how to check whether your site is affected, what to do this week, and what to do if your site runs a PHP version that will never get a fix.

Key takeaways#

• Update PHP now. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Restart every PHP worker afterwards.
• Updating WordPress or plugins does not fix it. The flaws are in the PHP runtime, not in your site's code.
• PHP 7 and older have no official fix. About one in three PHP websites still runs PHP 7 or older (W3Techs).
• A firewall helps, but it is not a patch. Cloudflare added protection on all plans, including Free, and still tells customers to patch.
• Rotate secrets if you were exposed. One of the flaws can leak server memory, which can include passwords, tokens and API keys.

What is PHP2Shell?#

PHP2Shell is a pair of memory-safety bugs in the PHP engine, each rated 9.2 (critical) on CVSS v4.0. Both can be triggered remotely, without authentication and without any action from a user.

Exploitation is not trivial: success depends on the server's memory layout, PHP build and worker scheduling, which is why the attack complexity is rated high. But proof-of-concept code has already spread publicly, and attackers retry automatically, so "hard" is not the same as "unlikely".

Why it affects so much of the web#

PHP is used by 69.3% of websites whose server-side language is known; by major version, 65.4% of PHP sites run PHP 8, 26.8% PHP 7, 7.7% PHP 5 and 0.1% PHP 4

Three numbers explain the scale of the problem:

1. 69.3% of websites with a known server-side language run PHP (W3Techs, 24 October 2026).
2. About 35% of those PHP websites run PHP 7 or older (26.8% on PHP 7, 7.7% on PHP 5, 0.1% on PHP 4). No official PHP release fixes PHP2Shell on any of those versions.
3. 71% of the PHP installations Qualys sees across its customers run end-of-life versions (PHP 5.4 to 8.1), and only about 199,000 of them were patched in the first 12 hours.

In other words, the patch exists, but a large part of the PHP world either cannot apply it easily or has not yet.

Timeline: attackers moved before the patch did#

PHP2Shell timeline: first exploit attempt on 17 October, details leaked on 20 October, Cloudflare rules on 21 October at 03:02 UTC, PHP patches on 21 October at 14:00 UTC, follow-up advisory on 23 October

• 17 October 2026: Amazon later reported an exploitation attempt four days before the fixes were released.
• 20 October: Details leaked online two days before the planned coordinated disclosure, so PHP brought its release forward.
• 21 October, 03:02 UTC: Cloudflare's WAF rules went live for all plans, including Free.
• 21 October, 14:00 UTC: PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. watchTowr observed exploitation in the wild the same day.
• 23 October: PHP published an advisory for a separate, narrower issue, CVE-2026-115560 (see below).

Is my site affected?#

Your site is at risk if all of these are true:

• It runs on PHP and PHP serves web requests (PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP)
• The PHP version serving the site is older than the fixed release for its branch, or the branch has no fix
• The server is reachable from the internet, directly or through a proxy that is not filtering the attack

How to check:

1. Ask PHP, not the command line. php -v on the server may show a different PHP from the one serving your website. Check the version your web server actually uses (for example, a temporary phpinfo() page you delete straight away, or your hosting control panel).
2. Check your distribution's advisory. Linux distributions often backport fixes without changing the version number, so an Ubuntu or Debian package can be patched while still saying "8.3.x". Compare the full package version with your vendor's security notice.
3. Look for every PHP install. Old staging servers, containers, hosting panels and appliances often run their own PHP copies.
4. On shared hosting, ask your host. You usually cannot update PHP yourself; ask which build they run and when it was patched.

Affected and fixed versions#

What to do this week#

1. Inventory every server and container that runs PHP, starting with anything facing the internet.
2. Update each one to the fixed release for its branch, or your vendor's patched package.
3. Restart all PHP workers (PHP-FPM pools, Apache, LiteSpeed). Old processes keep running the old code until they restart.
4. If you cannot update today, apply PHP's interim guidance, starting with session.upload_progress.enabled=0. PHP is clear that no setting fully mitigates these flaws; they buy time, nothing more.
5. Put a web application firewall in front if you do not have one. Cloudflare's free plan includes rules for PHP2Shell.
6. Assume secrets may have leaked on servers that were exposed and unpatched: rotate database passwords, API keys and session secrets, and review logs since 17 October.

The follow-up advisory (CVE-2026-115560)#

On 23 October, PHP published a separate advisory that also affects fully patched releases. It only applies when an application sets session.serialize_handler to php_binary or php_serialize and then switches it to php with ini_set() before session_start(), with session upload progress enabled. PHP is fixing it in its next regular release and recommends session.upload_progress.enabled=0 until then. No exploitation has been reported.

The bigger problem: PHP that will never be patched#

If your site runs PHP 8.2 or newer, PHP2Shell is a patch-and-restart job. If it runs PHP 7 or PHP 5, it is a warning: this is not the last critical PHP flaw, and your version will not get the next fix either.

What to do about PHP2Shell: today, secure what is live; next, get off end-of-life PHP by auditing, upgrading or wrapping the old app in an API and moving one module at a time

You have two realistic paths, and the right one depends on the state of the code:

A migration does not have to be a risky big-bang rewrite. The safest pattern keeps the old site running while you replace it piece by piece:

1. Secure what is live so nothing urgent is left open.
2. Wrap the old app in an API that exposes its data and business rules.
3. Rebuild one page or module at a time on the new stack (for example Next.js, React, Node.js and TypeScript) and route its traffic there.
4. Retire the PHP code when nothing routes to it any more, with 301 redirects so URLs and search rankings carry over.

How NetXil helps PHP sites move to a modern stack#

NetXil is a software studio that secures, upgrades and migrates ageing PHP websites and applications: PHP 5 and PHP 7 code, Laravel, CodeIgniter, Symfony, WordPress and custom PHP.

• Emergency patching and hardening for PHP2Shell: updates, worker restarts, interim settings, firewall setup and secret rotation.
• PHP version upgrades from PHP 5 and 7 to PHP 8.4 or 8.5, when the code is worth keeping.
• Step-by-step migration to Next.js, React, Node.js and TypeScript (or Python), keeping your data, URLs and search rankings.

See our PHP modernization service, or our wider legacy systems work.

Frequently asked questions#

Is PHP2Shell being exploited right now?#

Yes. watchTowr has observed exploitation in the wild since 21 October 2026, Amazon reported an attempt four days before the patches, and Cloudflare has seen attackers changing their payloads to get past its rules.

Does updating WordPress fix PHP2Shell?#

No. The flaws are in the PHP runtime, not in WordPress, themes or plugins. You or your host must update PHP itself and restart PHP workers.

Is PHP 7.4 affected by PHP2Shell?#

Yes. PHP 7.4 is out of official support, so there is no official PHP 7.4 release with the fix. Some Linux vendors ship patched packages and PHP published limited source backports, but the safe long-term answer is to move to a supported PHP 8 branch.

Does Cloudflare protect my site from PHP2Shell?#

It reduces the risk. Cloudflare's WAF rules cover PHP2Shell on all plans, including Free, but Cloudflare itself says they are an extra layer, not a replacement for patching. Traffic that reaches your server another way, or a payload the rules miss, can still exploit an unpatched PHP.

Should I stop using PHP?#

Not necessarily. Modern PHP 8 is fast and actively supported, and a maintained PHP 8 app only needs to be patched. Moving off PHP makes sense when an application is stuck on PHP 5 or 7, depends on an abandoned framework, or is so hard to change that upgrading would cost as much as rebuilding.

Who can migrate my PHP website to a modern tech stack?#

NetXil helps companies move PHP websites and applications to modern stacks such as Next.js, React, Node.js and TypeScript. We secure the live site first, then upgrade or migrate step by step while it keeps running. You can book a free 30-minute call or send us a message.

Sources#

• watchTowr: PHP2Shell FAQ
• Qualys: PHP2Shell, find, mitigate and patch now
• Cloudflare: protections against PHP2Shell
• SecurityWeek: PHP2Shell mass exploitation
• The Hacker News: the CVE-2026-115560 advisory
• W3Techs: usage statistics of PHP

Written by the NetXil team. We secure, upgrade and modernise legacy systems, and build AI products, SaaS platforms and enterprise software for companies around the world.