PHP2Shell: critical PHP flaws exploited worldwide (2026)
- When
- Since Oct 21, 2026
- Where
- Worldwide
- Scale
- Any unpatched PHP server
- Status
- Patches out; actively exploited
- Attribution
- Unknown
PHP2Shell is the name given to two critical flaws in PHP itself, the programming language behind most websites: CVE-2026-109618 and CVE-2026-109619. They let an attacker with no account run code on a web server, and read memory that can hold passwords, login tokens and keys from other users' requests. Because the flaws are in PHP, not in a site's own code, even a well-built site is exposed if its PHP version is unpatched. Nearly every PHP version back to 5.4 is affected; risk is highest on Apache with mod_php.
PHP released fixes on October 21, 2026, a day after details leaked. Exploit attempts followed within days, and CISA confirmed active exploitation on October 26. Some governments took services offline as a precaution. Hundreds of products that bundle PHP (network, industrial and security devices) have their own advisories.
Israel United States CVE-2026-0257 CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVE-2026-46300 Cisco
Timeline
- The flaws are reported to PHP; Wiz finds them independently on Aug 24 (researchers from Wiz, Calif and OpenAI are credited).
- Details leak ahead of a planned Oct 22 disclosure.
- PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and an advisory urging everyone to update. U.S. and UK agencies urge immediate patching.
- The UK says 32 government services are offline as a precaution; the NCSC says it has no sign of successful exploitation. Cloudflare reports exploit attempts in the millions.
- PHP warns of a separate, less likely flaw (CVE-2026-115560) that the Oct 21 releases do not fix and advises turning off session upload progress.
- A researcher confirms successful code execution against honeypot systems.
- CISA adds both flaws to its Known Exploited Vulnerabilities list; U.S. federal civilian agencies must fix them by Oct 29.
- Security firms report scanning and intrusions; one firm's North Korea attribution is unconfirmed (see claims).
What we know
Each claim is labelled: Confirmed Claimed by attacker Claimed, unverified Company denies Reported Disputed Retracted
- Confirmed PHP fixed two critical flaws (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released Oct 21, 2026. (The Hacker News)
- Confirmed CISA added both flaws to its Known Exploited Vulnerabilities catalog on Oct 26, meaning it has evidence of active exploitation; federal civilian agencies had until Oct 29 to fix them. (CISA)
- Reported A researcher confirmed successful remote code execution against honeypot systems on Oct 24, including memory disclosure. (The Hacker News)
- Reported Censys estimated more than 32.5 million PHP services were still running an affected version. (The Hacker News)
- Retracted Palo Alto Networks Unit 42 first said attackers used PHP2Shell to break into a European government agency; it later said it cannot confirm the initial access used these flaws. (The Hacker News)
- Claimed, unverified Security firm CYFIRMA says a suspected North Korea-linked operator is scanning PHP servers for PHP2Shell; no government has confirmed this attribution. (The Hacker News)
- Reported Exploitation can also read memory from the PHP worker that may contain passwords, tokens, API keys and certificates from other requests, without first running code. (The Hacker News)
What was affected
PHP2Shell is a flaw, not a single breach, so there is no single list of stolen data. On an unpatched server, an attacker can run commands and can read memory that may hold passwords, session tokens, API keys and certificates. No authority has published a confirmed list of organizations breached through PHP2Shell. Some government services went offline as a precaution.
What to do
Site owners and hosting customers: update the PHP that serves your site to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer (or your Linux vendor's fixed package; check its changelog for the CVE numbers, since the version string may look old), then restart Apache, PHP-FPM and any long-running PHP workers. Updating WordPress, Drupal or Laravel does not update PHP itself.
PHP 8.1 and older get no updates from the PHP project: upgrade, or ask your vendor for a backported fix.
If you cannot update today, PHP's advisory lists partial mitigations (for example session.upload_progress.enabled=0) but says only the update fully protects a server.
If your server was exposed before you patched, assume secrets in memory may be compromised: rotate passwords, API keys, session secrets and certificates, and check for unknown files or processes.
Check your device makers' advisories: many network, storage, industrial and security products bundle PHP.
Everyday users: there is nothing to install on your phone or computer. If a site you use tells you to reset your password, do it.
Severity: Critical = physical or safety impact, active exploitation at scale, or an official government warning; High = confirmed attacks on many organizations; Moderate = limited or unconfirmed impact.
Change log
- Page text set (approved by Nicolas 2026-11-11).
- Claim added (confirmed).
- Claim added (confirmed).
- Claim added (reported).
- Claim added (reported).
- Claim added (retracted).
- Claim added (claimed unverified).
- Claim added (reported).
- Published after editor review.
