PHP2Shell: Two Critical PHP Flaws, and What to Ask Your Developer Today

On 21 October 2026 (yesterday) the PHP team released fixes for two flaws that let an attacker run commands on a web server with a couple of crafted requests. No password needed, and no bug in your website required.

How much of the internet is affected?

Sources: W3Techs, 22 October 2026, and VirusTotal via BleepingComputer.

PHP powers WordPress, Drupal, Joomla, Magento, Laravel and a lot of custom business systems. If your website, online store or customer portal is more than a few years old, there is a good chance it runs on PHP.

What is the flaw?

An attacker sends a request designed to make PHP fail in a particular way, then a second one that takes advantage of the mess left behind. The result is code running on your server with your website's permissions. A second version of the attack reads passwords, login tokens and API keys out of the server's memory.

Wiz Research, who found and reported both flaws, put it plainly: "Exploitation does not depend on a flaw in the application's code." A plain "Hello World" page is enough.

Which versions are fixed?

Ubuntu, Debian, Red Hat and other Linux vendors ship the fix under their own version numbers, so check your vendor's notice too. Every setup is affected: Apache with mod_php (the highest risk), PHP-FPM, FrankenPHP and LiteSpeed.

Is it being used in attacks?

Yes. Cloudflare and watchTowr saw attack traffic on release day, and ELLIO logged one attacker writing a backdoor onto a server 81 minutes after first probing it.

The day before the fix, security researcher Kirill Firsov posted a video of the attack running against WordPress 7.1.3, Magento 2.4.9, a Laravel 8 site behind nginx, and plain PHP on Apache.

The exploit code on GitHub is a different story. Elias Taylor tested it and found that "they do not work against a vanilla PHP instance," and Recorded Future agrees nothing public is proven yet. So working attacks exist, but they are not yet in everyone's hands. That gives you days, not weeks. And do not run "PHP2Shell exploit" code from GitHub against your own servers: you cannot easily tell what it really does.

How did AI come into it?

Two teams found these bugs separately, both using AI. Wiz used Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Calif found one of the flaws with GPT-5.6 Sol. The bugs had been in PHP for more than ten years. With AI help, Wiz went from the first find to a working attack on WordPress in two days.

OpenAI calls it "one of the most impactful security issues in recent memory" and expects findings like this to "increase sharply in the coming months." We made the same point when GLM-5.3 showed anyone can now download an AI model that builds attacks: the gap between a fix and an attack keeps shrinking.

Timeline

• 19 August: Wiz finds the first flaw. Two days later it has a working attack on WordPress.
• 24 August: reported to PHP.
• 20 October: details leak on social media. Firsov posts his demo.
• 21 October, 03:02 UTC: Cloudflare's firewall rules go live for all customers, including free plans.
• 21 October, 13:30 UTC (9:30 pm in Perth): PHP releases the fixes. The UK NCSC and CERT-EU issue alerts.

What should you do?

Ask your host or developer three questions today:

1. Which PHP version do our sites run? Include the old ones: the 2019 microsite, the booking plugin, the staff intranet.
2. Who is updating them, and by when? You want a name and a day this week.
3. Is anything on PHP 8.1 or older? That needs an upgrade, not a patch, so it needs a plan.

If something cannot be patched quickly, the UK NCSC's advice is to apply the workarounds, or take it offline.

For technical teams

• Check the version you actually run. OpenAI's PHP2Shell checker flags vulnerable versions.
• Patch, then restart every PHP worker. Old PHP-FPM or Apache processes still run the old code.
• Rebuild container images and redeploy. Laravel Forge and Laravel Cloud apps may need a redeploy too.
• Put a firewall in front while you patch. Cloudflare's managed rules cover it on every plan. Set them to block, not log.
• If you cannot patch yet, set session.upload_progress.enabled=0 and tighten post_max_size. These reduce the risk; they do not remove it.
• Look for signs of attack: unusual multipart uploads followed by memory errors or bursts of HTTP 500s, and odd PHPSESSID cookies. If a server was exposed for a while, rotate the passwords and keys it held.
• Check appliances. Firewalls, NAS boxes and control panels often ship their own PHP.

Under the Essential Eight, internet-facing services must be patched within 48 hours when a flaw is critical or a working exploit exists. PHP2Shell is both.

What we have done

Every PHP server we maintain was checked within hours of the release. Our clients' servers are patched or scheduled, and anyone on an old PHP version has been contacted about an upgrade.

Frequently asked questions

Our WordPress site is with a managed host. Are we safe?

Probably soon, if not already. Ask them to confirm the date they patched. If you run your own server, even a cheap one, it is your job.

Our site is built with Laravel. Does updating Laravel fix it?

No. The flaw is in PHP, not Laravel. Firsov's video shows a Laravel site being taken over. Update PHP.

We are on PHP 7. What now?

There is no official fix. Some long-term support vendors offer their own patches, but the real fix is moving to a supported version. If the application has not been touched in years, that takes work, so start now. Our save my project service exists for exactly this.

Not sure what PHP version you run? Send us your website address and we will tell you, free. For ongoing patching, see our cloud maintenance service.

Photo credits. All images used under the Unsplash License — free for commercial use, attribution appreciated:

• The elePHPant, PHP's mascot, on a laptop — Ben Griffiths

Sources

• PHP advisory for CVE-2026-109618 and CVE-2026-109619 — PHP security team, 21 October 2026.
• PHP2Shell: AI uncovers critical RCE vulnerabilities — Wiz Research. Discovery, AI use, signs of attack.
• Patch the Planet — OpenAI, 21 October 2026. Who found what, the coordinated response, the version checker.
• PHP usage statistics and WordPress usage statistics — W3Techs, 22 October 2026.
• php2shell demo video — Kirill Firsov, 21 October 2026.
• CERT-EU Security Advisory 2026-018 and UK NCSC alert — 21 October 2026.
• Cloudflare deploys protections against php2shell — Cloudflare.
• PHP2Shell: what we observed — ELLIO. Attack traffic.
• There isn't an easy exploit for this PHP vulnerability — Elias Taylor, and PHP2Shell exploitation explained — Recorded Future. Status of public exploit code.
• PHP ships emergency patches — BleepingComputer. Exposure estimate.