If you own a website, run an online shop, or work anywhere near IT, give me three minutes. This one matters.
On Tuesday, details of two serious flaws in PHP leaked online before the official fix was ready. By 8:43pm on Wednesday, New Zealand time, Cloudflare was already seeing attacks. The fix arrived at around 3am this morning, while most of us were asleep.
The flaws have a nickname: PHP2Shell. It describes a path from "a website running PHP" to "a stranger with a command line on your server."
First, what is PHP?
You have almost certainly used it today without knowing.
PHP is the engine behind a huge part of the web: WordPress blogs, WooCommerce and Magento shops, booking systems, school portals, company intranets. When you click "Submit" on a form, there is a good chance PHP is the thing on the other end catching it.
According to W3Techs, PHP runs on roughly 7 out of every 10 websites whose server language can be identified.
So when PHP itself has a flaw, it is not one company's problem. It is everyone's.
What actually went wrong?
Think of a busy restaurant.
Every time a visitor loads a page, PHP is like a waiter who sets a table, serves the guest, then hands the table to a cleaning crew. Thousands of times a minute, all day, for years. PHP2Shell is two different ways that handover breaks.
Bug 1: the half-set table (CVE-2026-109618). An attacker sends a request designed to make PHP run out of memory halfway through setting up. PHP stops abruptly. But the cleanup crew assumes the table was properly set and starts working with it anyway. That half-set table is the opening an attacker uses.
Bug 2: the room nobody cleaned (CVE-2026-109619). PHP reuses the same worker for many visitors, like a hotel reusing rooms. Under certain errors, leftovers from one visitor survive into the next visit. The next request walks in, finds the previous guest's things, and trusts them as if they were fresh.
Both end in the same place: someone with no password and no account can, under the right conditions, get your server to run their code. Both were rated 9.2 out of 10 for severity.
There is a second, quieter risk too. Researchers say these flaws can also be used to read bits of the server's memory. That memory can hold passwords, API keys and session tokens belonging to other visitors.
Why this one is different
Three things make PHP2Shell stand out from the usual "update your software" warning.
1. Your code can be perfect and you are still exposed. The flaw is in PHP itself, not in your website. Researchers at Sansec point out that Magento, WooCommerce and Shopware stores are at risk even if their own code is spotless. On one common setup (Apache with mod_php), PHP's own advisory says the attack works before a single line of the website's code even runs.
2. It has been there since 2012. The vulnerable code goes back to PHP 5.4. That is 14 years of websites quietly carrying it.
3. It leaked before the fix. Normally, researchers report a bug privately, the fix gets built, and everything is announced together. Here, the details escaped a day early. PHP pulled its release forward, but attackers had a head start of several hours.
One more detail I find fascinating as someone who works with emerging tech: the teams credited with finding these flaws include Wiz, Calif and OpenAI, and Wiz says it used a mix of AI models to help find and fix them. A bug that hid from human eyes for 14 years was found with AI in the loop. I suspect we will be seeing a lot more stories shaped like this one.
Is anyone actually being hacked?
Here is the honest picture as of 22 October 2026:
- Cloudflare, watchTowr, Aikido and others have seen attack attempts in the wild.
- watchTowr told SecurityWeek it had not yet seen a successful one, but expects that to change.
- No confirmed break-ins have been publicly reported, and the US agency CISA has not added it to its list of known exploited vulnerabilities yet.
- The UK's National Cyber Security Centre has advised organisations to consider taking unpatchable systems offline.
In other words: the burglars are trying the door handles. Do not wait to find out whether yours is locked.
Am I affected?
If your website runs on PHP, check its version. That is it. One number.
- PHP 8.5: you need 8.5.12 or later
- PHP 8.4: you need 8.4.27 or later
- PHP 8.3: you need 8.3.36 or later
- PHP 8.2: you need 8.2.35 or later
- PHP 8.1 or older: no standard fix is coming. These versions are past their end of life. Some Linux vendors may backport a fix, but the real answer is to upgrade.
That last group is the worrying one. Researchers scanning the internet report that a majority of exposed PHP servers are running these older versions.
What should you do today?
If you own a website but are not technical: Message your hosting provider or web developer today. Ask one question: "Is my site's PHP patched for PHP2Shell?" If the answer is "we're not sure," that is your answer. If you are on managed hosting, they may already have done it. Get a yes in writing.
If you are a developer: Update PHP everywhere it lives, not just on the main server. Think Docker images, staging boxes, CI pipelines, that old side project still online. Patching your app's code does nothing here; the runtime is what needs updating.
If you are responsible for IT: If you cannot patch right now, put a shield in front. Cloudflare, Google Cloud Armor and others have released firewall rules for the known attack patterns. Isolate the most exposed apps, and seriously consider taking anything unpatchable offline until it is fixed. Once patched, it is worth rotating passwords and keys stored on those servers, because of the memory-leak risk.
The bigger lesson
We tend to think about security as "my code, my passwords, my responsibility." PHP2Shell is a reminder that most of what keeps a website alive is software we did not write and rarely think about. It works so reliably that we forget it is there, until the day it is not.
Updating is not glamorous. But this week, it is the single most useful thing you can do for your website, your customers and their data.
If this helped, please share it with the one person in your life who has a website and will not read a security bulletin. That is exactly who this was written for.
Sources: PHP security advisory (via Help Net Security), Google Cloud / Wiz Research, Palo Alto Networks Unit 42, Red Hat, Rapid7, Datadog Security Labs, Sansec, SecurityWeek, CyberScoop, watchTowr, Huntress, CybelAngel, Mend, W3Techs.