PHP2Shell: What the Critical PHP Flaw Means for Your Website

Today, 21 October 2026, the PHP team closed two critical security flaws that go by the name PHP2Shell. By mid-morning, government portals, hospitals and city websites were offline, and several hosting providers had switched off features. What is behind it, who it hits and what you should do now is set out below. We name the sources in the text.

What happened

PHP2Shell is the nickname for two flaws in the core of PHP:

• CVE-2026-109618: If PHP runs out of memory while reading a request, it aborts while internal data is only partly set up. The cleanup then treats that data as valid anyway.
• CVE-2026-109619: Internal state survives the end of a request even though its memory has already been freed. The next request in the same PHP process may use it.

The PHP team rates both at 9.2 out of 10 under CVSS 4.0. In both cases an attacker can run their own code on the server without logging in, with the rights of the PHP process. The technical write-up was published by the security company Wiz. According to Wiz, AI models played a major part in finding the flaws and building the exploit.

The timeline according to Wiz, the PHP team and Patchstack:

• 24 August 2026: reported to the PHP security team.
• 20 October: details leak ahead of the planned date. The PHP team announces updates for the next day, and the EU institutions’ emergency response team (CERT-EU) issues a warning.
• 21 October, 07:34 UTC: hosting providers report the first attacks to Patchstack. Shortly afterwards Cloudflare confirms attacks and deploys filter rules.
• 21 October, 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released.

Germany’s Federal Office for Information Security (BSI) issued a security notice at level 3/orange the same day.

Why so many sites went offline

CERT-EU advised organisations that cannot patch quickly to isolate their internet-facing applications until a fix is in place. Many took that literally. According to The Record, the Dutch broadcaster NOS and the German blog Borns IT- und Windows-Blog, sites that were temporarily unreachable included DigiD and MijnOverheid in the Netherlands, Charité hospital in Berlin, the websites of several German cities such as Cologne, Düsseldorf and Dresden, and sites of regional intelligence agencies.

Hosting providers reacted too. According to Borns IT-Blog, IONOS disabled Nextcloud instances as a precaution and manitu blocked form uploads with attachments. That is no coincidence: the attack uses exactly the kind of request browsers send to upload files (multipart/form-data).

The reason for the caution: according to Wiz, PHP runs on around 70 percent of all websites, and the vulnerable code has existed since PHP 5.4 from 2012. That covers practically every WordPress, Shopware, Drupal or Laravel installation, as well as Nextcloud, Roundcube and phpMyAdmin.

Who is affected

According to php.net, every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team sees the highest risk with mod_php, where a single unauthenticated request can trigger the attack before any application code runs.

That is the key point for site owners: your CMS cannot protect you. WordPress, Laravel or Shopware only see the request after PHP has already processed it. A security plugin, a login lock or maintenance mode come too late.

PHP version	Status
8.5, 8.4, 8.3, 8.2	Fix available: 8.5.12, 8.4.27, 8.3.36, 8.2.35
8.1, 8.0, 7.4	Source-code fixes from the PHP project only, packages at most from a distribution or LTS vendor
7.3 and older	No fix

What to do now

1. Check the version on the web server, not in the terminal. The command line (php -v) often uses a different PHP version than the website. In WordPress, Tools → Site Health → Info → Server shows the version that actually serves pages. The hosting panel works too.
2. On shared hosting, check your host. The host installs the fix. Look at their status page or customer notice. If your site is still on PHP 8.1 or older, switch it to 8.2 or newer in the panel. How to do that without downtime is covered in our article Updating the PHP version in WordPress.
3. On your own servers, update and restart. Update the distribution packages, then restart all PHP-FPM pools and the web server. Running processes otherwise keep using the old code.
4. Rebuild containers. Docker images bring their own PHP. Update the base image, rebuild, redeploy. That also applies to staging and test environments that are publicly reachable.
5. Find every PHP installation. Not just the main site: old microsites, customer portals, phpMyAdmin, Nextcloud, a forgotten shop test system. According to Sophos, locating all of them is the real hurdle for many organisations.
6. Do not install “fix plugins”. Patchstack explicitly warns against unofficial plugins claiming to close the hole. That is not possible at the application level.

If you cannot patch right away

The PHP team is clear: there are no complete mitigations, and updating is the only safe choice. As a bridge for a few hours, Sansec and the German magazine Dr. Web list:

• Take the site offline or replace it with a static maintenance page served by the web server without PHP.
• Block file uploads at the web server, i.e. reject requests with Content-Type: multipart/form-data in nginx or Apache. This breaks contact forms with attachments, image uploads and some checkouts.
• Disable session.upload_progress.enabled. This takes the edge off part of the attack path, not all of it.

None of these replaces the update. They buy time.

How to spot an attack

Wiz lists unusual upload requests followed by memory-limit errors or repeated 500 errors, and unexpectedly large or malformed PHPSESSID cookies, as traces in the server logs. Because Patchstack and Cloudflare saw attacks hours before the patch, it is worth looking even if your host has updated since.

At the application level, the signs are the same as for any other break-in: new PHP files in the upload folder, unknown admin accounts, modified core files, redirects to unknown sites. How to proceed is described in WordPress hacked? Recognising and cleaning up malware. The update closes the door, but it does not remove anything that is already inside.

What PHP2Shell says about maintenance

Nobody could have predicted the flaw itself. How hard it hits you, you could. According to The Record, roughly half of all PHP websites run outdated versions, and Dr. Web puts the share of WordPress sites on PHP 8.1 or older at 36.4 percent. If you are on 8.3 or 8.4 today, you are waiting for your host. If you are on 7.4, you have a migration project under time pressure.

Three things to take away from the day:

• The PHP version is part of maintenance. PHP 8.2 only gets security fixes until the end of 2026. If you update to 8.2 now, plan the step to 8.4 right away.
• Keep a list of all systems. If you know where PHP runs, a day like this takes minutes instead of hours.
• Static does not automatically mean PHP-free. Our own website is a static Astro site too, but the contact form runs through a PHP script at our host. Single scripts like that belong on the list as well.

What regular maintenance covers, including PHP updates, is described in our overview Securing WordPress.

---

You don’t know which PHP version your site runs on, or it is still stuck on 8.1 or older? Get in touch via our WordPress emergency page or send us a short message. We will look at what needs doing and give you an honest estimate of how long it is likely to take.