PHP2Shell: impact on web hosting and what customers should do

PHP2Shell is the name given to two critical vulnerabilities in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, which allow an unauthenticated remote attacker to execute code on a web server or to read sensitive data from process memory. Because the flaw sits in the language runtime rather than in any single application, every hosting environment that runs PHP is potentially in scope. We have updated our servers to the latest patched PHP releases, and customers should now complete their own part of the work: review traffic, scan their sites, verify their users and rotate administrator credentials.

TL;DR

• PHP2Shell comprises two PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS v4.0 9.2 (Critical) by Sophos, and exploitation attempts were reported before public disclosure.
• Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official release and must be migrated.
• We have updated our servers to the latest PHP versions to mitigate the issue at platform level.
• Customers should analyse abnormal traffic, run the antivirus scan from our customer portal on every site, confirm that all users on their platforms and WordPress sites are legitimate, and rotate administrator passwords on PHP applications.

Table of Contents

• What PHP2Shell is and why it matters for hosting
• Anatomy of the two vulnerabilities
• Affected versions and fixed releases
• Timeline and current exploitation status
• How we have responded on our servers
• What customers should do now
• Content management systems and custom applications
• If you cannot update immediately
• Our perspective
• Support with migration and audit
• FAQ
• Sources

What PHP2Shell is and why it matters for hosting

The two vulnerabilities were disclosed in October 2026. According to Wiz Research, they combine memory disclosure with unauthenticated remote code execution in PHP itself, and a successful attacker could take control of an affected server, steal sensitive data or deface websites. The same publication states that PHP powers 70% of all websites in the world and that every PHP version released in the last decade, going back to 5.4, is affected by at least one of the two flaws.

For a hosting provider and its customers, the significance lies in where the weakness resides. Most web security incidents originate in a vulnerable plugin, a weak password or a misconfigured application. Here, Wiz demonstrated that its exploit script could execute code without authentication on the then-latest container images of WordPress, Drupal and Joomla, and that exploitation does not depend on a flaw in the application’s code. A site that was fully patched at application level could therefore still be exposed through the runtime beneath it.

The consequences are described consistently by several vendors. Dynatrace notes that an attacker executes code with the privileges of the web server process, which typically exposes credentials, database connections, user sessions and customer data, and that CVE-2026-109618 can also leak passwords, tokens and API keys from process memory without any code execution. In a shared or multi-site environment, that distinction matters: credentials read from memory can be reused long after the vulnerable runtime has been patched.

Anatomy of the two vulnerabilities

Both issues stem from how PHP behaves when a request is interrupted by a fatal error, and they are best understood as a pair.

CVE-2026-109618: out-of-memory handling

Akamai explains that the attacker sends a crafted request designed to consume memory rapidly until it reaches PHP’s configured memory_limit. When the core detects the out-of-memory condition it unwinds the stack with longjmp, which leaves certain internal structures uninitialised or dangling, and the attacker can then exploit them during the request shutdown phase. Calif Research adds that request shutdown may free memory that surviving state still references, and that an application exposes the vulnerable path through a reachable decoding operation such as session_start, session_decode or unserialize, including wrappers such as the maybe_unserialize function used by WordPress.

The PHP Foundation states that on Apache with mod_php an unauthenticated request can trigger this vulnerability before any application code runs, and that full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths. This is why defences that live inside the application, or inside the PHP process, cannot be relied upon alone.

CVE-2026-109619: use of freed memory across requests

Dynatrace describes a two-stage sequence. A first crafted request triggers a fatal condition and leaves a PHP worker holding a reference to memory that has already been freed. A follow-up request handled by the same worker can then reclaim and shape that memory so that execution is redirected to an attacker-supplied command. The persistence of the worker between requests is what turns an apparently transient error into a reliable foothold.

AhnLab reproduced the exploit and observed the victim server opening a connection to the attacker’s system and running commands under the web service account, www-data. For a hosting environment, this is the practical picture: an anonymous visitor obtains the same rights as the web server itself.

Affected versions and fixed releases

Google Cloud states that versions from 5.4 through 8.5.11 are vulnerable and that the project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life. Datadog Security Labs lists the fixed version for each supported branch.

BleepingComputer reports that the PHP security team supplied minimal source backports for PHP 7.4, 8.0 and 8.1 for those building from source or without access to an LTS vendor. Such backports are a stopgap for organisations that cannot move immediately; the durable remedy is migration to a supported branch.

Timeline and current exploitation status

The sequence matters because it explains why patching has been treated as urgent. Sophos reports that the existence of the vulnerabilities became public ahead of coordinated disclosure on 20 October 2026, that Amazon Threat Intelligence observed an exploitation attempt on 17 October, before public disclosure, and that other vendors have since reported further attempts. Akamai states that the CVE identifiers were leaked early, before the scheduled details release. CERT-EU records that PHP published the fixes on 21 October 2026 and that initial proofs of concept had begun to circulate, raising the likelihood of active exploitation.

In the United States, CISA published an alert on 21 October urging immediate patching and added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October 2026. For any organisation, in any region, that listing is a reasonable signal that the window for deferred patching has closed.

How we have responded on our servers

We have updated our servers to the latest versions of PHP in order to mitigate the issue at platform level. This addresses the runtime layer, which individual customers cannot patch from within their own accounts. It does not, however, replace the checks that only the owner of a site can perform. Two reasons make those checks necessary.

First, exploitation attempts began before the fixes existed. A site may have been probed, or compromised, during the period in which the vulnerabilities were public and no patch was available. Updating the runtime closes the door; it does not reveal whether someone has already passed through it.

Second, the memory disclosure aspect means that credentials and tokens may have been exposed without any visible change to the site. This is the rationale for the credential-oriented steps below.

What customers should do now

The following four actions form a coherent sequence, from detection to containment. They should be treated as a single exercise rather than independent options.

Analyse abnormal traffic

Begin with the access and error logs from the period since mid-October 2026. Attempts to exploit CVE-2026-109618 rely on requests that exhaust memory until the configured limit is reached, so unusual spikes in error entries concerning memory exhaustion, repeated large or malformed requests to a single endpoint, and bursts of requests to session or upload-related paths deserve attention. CISA recommends monitoring for suspicious activity, in particular PHP worker processes launching shells or downloading tools. Outbound connections from the web server to unfamiliar hosts, which is the behaviour AhnLab observed in its reproduction, are an equally important indicator.

Run the antivirus scan from the customer portal

Run the antivirus scan available in our customer portal on every site you operate, including staging copies and forgotten subdomains. A successful remote code execution commonly leaves behind web shells, modified core files or injected code in themes and plugins, and a scan is the quickest way to surface known malicious files. Repeat the scan after any clean-up, since an attacker who retains a foothold may restore removed files.

Verify that every user is legitimate

Review all accounts on your platforms and WordPress sites. Attackers who reach a server frequently create an additional administrator or editor account to preserve access, and that account survives both a runtime update and a file clean-up. Remove accounts that nobody can account for, check that the roles of existing accounts match their purpose, and examine recently created users in particular. Where a second factor is available, enforcing it on privileged accounts reduces the damage from any stolen password; hardware two-factor authentication for WordPress is one approach to consider for administrator logins.

Rotate administrator passwords on PHP applications

Because memory disclosure can expose passwords, tokens and API keys, rotate the passwords of every administrator on your PHP applications, and replace the database credentials, API keys and secret salts stored in configuration files. Rotate after the runtime has been patched and after the scan is clean; otherwise the new credentials may be exposed in the same way as the old ones. Sessions issued before the rotation should be invalidated.

Content management systems and custom applications

Because the flaw is in PHP, the whole ecosystem built on it is relevant: WordPress, Joomla, Drupal, Magento and bespoke applications written in frameworks such as Laravel. CERT-EU observes that many commercial and open-source products embed PHP as a backend technology and may be affected even if they do not directly expose a PHP installation, and CISA similarly advises organisations to inventory every system running any version of PHP, since PHP is often a component of other software and may not be directly observable.

For Joomla operators in particular, a review of the extensions and protective layers installed on the site is a sensible complement to the runtime update, and an overview of security plugins for Joomla can help structure that review. Plugins and extensions do not substitute for patching PHP, but they reduce the exposure of the application layer around it.

If you cannot update immediately

Customers running their own infrastructure, rather than our hosting, may be unable to patch at once. The official guidance is consistent. CISA urges immediate updating to a fixed release, prioritising internet-facing systems, and advises that organisations unable to update, or still on PHP 8.1 or earlier, should take PHP-based systems offline until they can be updated. CERT-EU suggests isolating internet-facing resources from public networks where patching is not feasible.

Sophos lists interim configuration measures from the PHP project: memory_limit=-1, session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, together with file_uploads = Off where an application accepts no uploads. Datadog adds that memory_limit=-1 should be enforced at administrator level and combined with request limits at the frontend and memory limits on the container, and that process limits such as RLIMIT_AS or RLIMIT_DATA should not be substituted, since they can trigger the allocation failures on which the vulnerability depends. Settings must load before PHP parses the request, and every worker must be restarted. Sophos stresses that this workaround is not a substitute for updating, and that in-process protections such as RASP or embedded WAF agents may not stop exploitation on Apache mod_php.

CERT-EU also notes that on 23 October 2026 PHP disclosed a further remote code execution issue affecting only applications configured in an unusual way, for which no out-of-band release will be issued and for which organisations are advised to apply mitigation. On managed cloud platforms, the picture differs: Google Cloud states that supported App Engine runtimes are patched automatically, whereas container images on Cloud Run and GKE must be rebuilt with a patched PHP and redeployed.

Our perspective

PHP2Shell is a reminder that infrastructure risk and application risk are the same risk viewed from different layers. A hosting provider can remove the vulnerable runtime, but it cannot know whether an account on a customer’s WordPress site was created by an attacker last week. That knowledge sits with the people who run the application, which is why we pair platform updates with clear instructions for customers.

In our engineering practice, we work directly with the engineers who design, build and maintain a system, without an account-manager layer in between. In an incident of this kind, that directness shortens the path from advisory to action: the person reading the CVE is the person who can tell you what it means for your architecture, your dependencies and your credentials.

The longer-term lesson concerns end-of-life software. PHP 8.1 and older will not receive an official fix, and any application pinned to those versions carries this exposure indefinitely. Migration planning, code audit and the reduction of technical debt are not optional hygiene; they determine how quickly an organisation can respond when the next advisory arrives. We recommend treating PHP2Shell as the occasion to inventory every PHP component, retire unsupported versions and document who owns each system.

Pepe F.

Support with migration and audit

If the inventory exercise shows applications on unsupported PHP versions, or if a scan has found signs of compromise, the next step is an engineering one. Our team handles code audit and technical debt, legacy modernisation and custom software development, and our consulting engagements end with written recommendations.

For organisations that want continuing technical oversight rather than a one-off project, our CTO advisory subscription starts with CTO Advisory from €1,800 per month, Fractional CTO from €4,000 per month and CTO Partner from €7,500 per month, and an initial assessment is available from €3,500 as a one-off. Examples of the work we deliver are collected in our case studies.

FAQ

Is my site affected if it runs on your hosting?

We have updated our servers to the latest PHP versions to mitigate the issue at platform level. Sites can still have been probed before the fixes were available, so you should run the portal antivirus scan, review traffic and users, and rotate administrator passwords.

Do I need to act if I only use WordPress?

Yes. Wiz demonstrated exploitation against the latest WordPress container image, and the flaw does not depend on a vulnerability in the application’s own code. WordPress sites should be scanned, their users verified and their administrator passwords rotated.

Can I stay on PHP 8.1 or older?

The PHP project is not releasing official fixes for PHP 8.1 or earlier, and CISA advises that systems on those versions should be taken offline until they are updated. Plan a migration to a supported branch: 8.2, 8.3, 8.4 or 8.5, in a fixed release.

Why rotate passwords if the server is already patched?

CVE-2026-109618 can leak passwords, tokens and API keys from process memory without code execution, and exploitation attempts predate the patches. Patching stops new exposure but does not invalidate credentials that may already have been read.

Sources

• Wiz Research: PHP2Shell, AI uncovers critical RCE vulnerabilities
• The PHP Foundation: today’s PHP security release
• Dynatrace: PHP2Shell, what it is and what to do
• AhnLab: PHP2Shell attacks, reproducing the exploit
• Akamai: understanding PHP2Shell
• Calif Research: PHP2Shell
• Google Cloud: responding to core PHP vulnerabilities
• BleepingComputer: PHP ships emergency patches
• Datadog Security Labs: PHP2Shell critical vulnerabilities
• CISA: critical vulnerabilities in PHP require immediate patching
• CERT-EU: security advisory 2026-018
• Sophos: PHP2Shell advisory

Recommended

• Case studies

This article was produced with AI assistance and reviewed for accuracy. It is provided for general information only and is not professional advice.