In short: PHP2Shell is the name for two critical security vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Through them, attackers can execute malicious code on vulnerable web servers without logging in. The only remedy is to update to a fixed PHP version and then restart all PHP processes.
What is PHP2Shell?
PHP is the programming language that a large share of all websites run on: company sites with WordPress or TYPO3, online shops with Shopware or WooCommerce, internal portals and custom developments. On 21 October 2026, the PHP project released security updates for two vulnerabilities that have become known under the name PHP2Shell.
Both vulnerabilities are rated 9.2 on CVSS v4.0, that is critical. The consequence is the same in both cases: remote execution of malicious code without the attacker having to log in. Experts speak of "unauthenticated remote code execution". Anyone who can execute code on the server can, in the worst case, read data, install backdoors or use the server for further attacks.
Important for understanding: the vulnerability is not in a particular CMS or plugin but in PHP. An update of WordPress, Shopware or TYPO3 therefore does not close it.
Why is the vulnerability so serious?
Three points make PHP2Shell particularly delicate from the point of view of security authorities:
- Breadth: The common operating modes of PHP are affected, namely PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Palo Alto Networks (Unit 42) counted more than 22.6 million exposed, potentially vulnerable instances.
- No login needed: The attacker needs neither a password nor a user account.
- Early point in time: With Apache and mod_php, according to the PHP team, an exploit was demonstrated before any application code even runs. Protective functions within the website then do not take effect.
The BSI (German Federal Office for Information Security) has declared warning level 3 (orange). It recommends updating immediately and, if that is not possible right away, taking the affected web servers off the network temporarily.
Which servers are affected by PHP2Shell?
The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions of these branches are affected. There are no official updates any more for PHP 8.1 and older; according to the trade press, nearly all versions going back to PHP 5.4 are affected. You will find the full overview on the page Which PHP versions are affected?.
One peculiarity: Linux distributions and hosting providers sometimes apply the fixes as a backport. Plesk, for example, then continues to display 8.2.34 although the flaw is fixed. What counts is the package version and the provider's confirmation. How to check this is explained at Checking the PHP version and patch level correctly.
What is proven, what is open?
Proven are the two CVE numbers, the fixed versions and the interim measures that php.net has published. On 23 October, an advisory about a further vulnerability was added, CVE-2026-115560, which only takes effect with an unusual configuration.
Probable is that attackers continue to actively search for unpatched servers. According to media reports, a first attack attempt was already observed on 17 October, that is before the patches were released. Cloudflare reported attack attempts and has rolled out protection rules, but points out that rules based on request data alone are not sufficient.
Open is how many servers have already been successfully attacked. According to the BSI, confirmed successful attacks at scale were not known at first. There are no published, confirmed indicators of compromise. Whether a server was affected can therefore only be assessed through behavioral analysis. The sequence of events is summarised in the chronology from 17 to 25 October.
What companies should do now
- Clarify who is responsible: your own server, a managed server or a hosting provider.
- Update PHP to a fixed version or a confirmed backport.
- Restart all PHP processes. New files alone are not enough as long as old processes are running in memory.
- Preserve logs from 20 October onwards. The trade press advises keeping this data.
- Check for traces. A patch does not remove malware that has already been planted and does not prove that nothing happened beforehand. Notes on this are on the page Am I already compromised?.
An update closes the door but does not clean up. If your server was reachable between 17 October and the patch, a check for traces is a duty, not an optional extra.
How does PHP SOS help?
With the PHP2Shell emergency help, we take over the steps that many companies cannot cover internally at short notice:
- Inventory: We determine the PHP version, operating mode and package version of each affected server.
- Patch or interim measure: We install the update or, where that is not yet possible, apply the interim measures from php.net and clarify whether the server has to go off the network temporarily.
- Restart and proof: We restart all PHP processes and document the state before and after.
- Trace check: We preserve logs from 20 October onwards and check for anomalies until the incident is closed and documented.
Frequently asked questions
Is PHP2Shell a WordPress vulnerability?
No. The vulnerabilities are in PHP, the programming language that WordPress, Shopware, TYPO3 and many other systems run on. A CMS update therefore does not close them. What matters is the PHP version on the server.
As a customer of a hosting provider, do I have to do anything myself?
With shared hosting, the provider usually installs the PHP update. You should still get written confirmation that the PHP version you use has been patched and restarted. The update does not answer whether something happened before the patch.
Where does the name PHP2Shell come from?
The name describes the consequence: through PHP, an attacker can in the worst case gain a command line, that is a shell, on the server. The official designations are the CVE numbers CVE-2026-109618 and CVE-2026-109619.
Has my website already been attacked if it was taken offline?
Not necessarily. Some providers took websites off the network as a precaution, as the BSI (German Federal Office for Information Security) recommends when an update is not immediately possible. That is a protective measure and not evidence of an attack.