Developers of PHP, one of the oldest and most widely used programming languages on the internet, released emergency fixes this week for two security flaws that could let hackers seize control of web servers.
The bugs, nicknamed PHP2Shell, could let attackers execute code remotely on web servers without logging in. Researchers warned that the flaws could expose millions of sites using it to potential hacks if left unpatched.
The response was swift. Websites around the world were taken offline on Wednesday and Thursday as operators moved to protect their systems.
What Happened
PHP2Shell refers to a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Their existence was publicly announced on 20 October 2026. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.
The flaws were discovered in August 2026 by researchers credited to Calif, OpenAI, Wiz.
PHP’s own security team rates both 9.2 (Critical) on CVSS v4.0, the industry’s standard severity scale.
Why It Matters
PHP runs behind a vast share of websites, from blogs and online stores to government portals. Popular platforms built on it include content management systems used by news outlets, small businesses and public agencies.
The problem sits in PHP itself, not in a single app built on top of it. That widens the blast radius. According to PHP’s advisory, every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, and php-cgi, the common ways servers run PHP code.
Attackers do not need a password. Security firm Datadog said its researchers triggered the out-of-memory corruption described in CVE-2026-109618 on PHP 8.5.11 with an unauthenticated HTTP POST request — a single crafted web request.
The bugs are also old. The vulnerable code has been present for more than a decade. Affected releases go back to PHP 5.4.
Attackers Moved Early
There are signs that attackers knew before the public did. According to Amazon Threat Intelligence, its MadPot honeypot network recorded a PHP2Shell exploitation attempt on Oct. 17, 2026, four days before the flaws were disclosed.
Some vendors report in-the-wild exploitation, still under investigation. The bugs are not yet in the Known Exploited Vulnerabilities (KEV) catalog kept by U.S. officials.
Britain’s National Cyber Security Centre struck a cautious tone. Its chief technology officer, Olly Whitehouse, called the event “unprecedented,” while he said there were “no indications” of any successful breaches by hackers.
The Older-Version Problem
The biggest risk may lie with servers that no one has updated in years.
Upstream only patches 8.2 through 8.5, so PHP 8.1, 8.0, 7.x and 5.x get nothing from php.net. One count found roughly 884,000 internet-facing hosts advertising one of those versions.
The PHP team offered a partial lifeline. It provided source backports for PHP 7.4, 8.0, and 8.1. But those fixes take extra work to apply, and versions older than that remain exposed.
For businesses and public agencies in regions where legacy systems linger — including many across Africa — that gap is the real concern. Old servers are often unmonitored and forgotten until something breaks.
What Site Owners Should Do
The fix is simple to state: update. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately.
Major Linux providers moved quickly. Linux distributions and long-term support (LTS) vendors got the patches ahead of the public release, so admins should check with their vendor for updated packages.
Security experts recommend a few steps:
- Check your version. Anything below the fixed release on its branch is vulnerable.
- Patch internet-facing servers first. They are the easiest targets.
- Restart PHP after updating. Running processes keep the old code until restarted.
- Plan an upgrade off old versions. Unsupported releases will keep falling behind.
Temporary configuration changes exist for servers that cannot be patched right away. But experts were blunt about their limits: none of the mitigations below can substitute the patch.
The Bigger Picture
PHP2Shell is a reminder that the internet rests on aging, shared code. A single flaw in a common building block can put millions of unrelated websites at risk overnight.
It also shows a shift in who finds these bugs. An AI company was among the discoverers, part of a wider trend of AI tools being used to hunt for security holes — by defenders, and potentially by attackers too.
For now, the race is between site owners applying patches and hackers scanning for those who have not.
