Cybersecurity
PHP2Shell: the critical PHP flaws and why you should update now
Two flaws in the PHP engine itself let attackers take over a web server without a password. We explain how they work, their worldwide impact and the dangers of putting off the update, even by a few days.
On 21 October 2026, the PHP security team released emergency updates for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known as PHP2Shell. Together, they let an attacker run their own code on a web server without needing any password. As PHP sits behind roughly seven in every ten websites, this is one of the most serious vulnerabilities in recent years.
In this article we explain how these flaws work, their impact worldwide and why putting off the update, even by a few days, is a risk no organisation should take. The information reflects what was public on 23 October 2026.
What PHP is and why this matters
PHP is the programming language that builds, on the server, the pages of a large part of the internet: institutional portals, online shops, blogs, management platforms and many internal applications. Very popular content management systems, such as WordPress, Drupal and Joomla, are built on it.
What makes these flaws unusual is that they are not in an application or a plugin, but in the PHP engine itself. Updating the website, the theme or the platform therefore does not solve the problem: the PHP installed on the server must be updated and every process running it must be restarted.
How the flaws work
To respond quickly, a PHP server keeps a pool of worker processes that handle requests one after another. At the end of each request, the process tidies up the memory it used and is ready for the next one. Both flaws exploit moments when that tidying up goes wrong.
CVE-2026-109618: memory running out halfway
When an operation runs out of memory, PHP abandons the request abruptly. If that happens while the request's internal data is still being prepared, it leaves incomplete structures behind that the final clean-up treats as valid. An attacker can trigger this with a specially crafted form or file upload, even within the configured size limits.
The risk is highest on Apache servers with the mod_php module: there, the flaw can be exploited before the application runs a single line of code, so it does not matter how well the website is written.
CVE-2026-109619: leftovers from an earlier request
The second flaw comes from internal information that survives from one request to the next, pointing to memory that has already been freed. A later request handled by the same process can read those leftovers before they are cleared. One of the confirmed paths goes through the file upload progress feature (session upload progress), which is enabled by default and does not require the application to use sessions.
In technical terms, both are use after free flaws (CWE-416), scored 9.2 out of 10 on the CVSS 4.0 scale. Every way of serving PHP on the web is affected, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed.
A fast-moving timeline
The flaws were discovered in August by two independent research teams, both helped by artificial intelligence tools, and reported in a coordinated way to the PHP team. The plan was to disclose them on 22 October, with the fixes already available. That is not how it went.
17 October: according to Amazon, the first exploitation attempts appear, four days before the fixes.
20 October: the technical details reach the public earlier than planned and an attack tool called PHP2Shell circulates. PHP announces an emergency update for the following day.
21 October: the fixed versions are released. Cloudflare reports tens of thousands of attack attempts in the first 45 minutes, hundreds of thousands within two hours and millions by the end of the day.
23 October: PHP announces a third, narrower flaw (CVE-2026-115560), related to the same upload progress feature, to be fixed in the next release.
Some of the information still conflicts. When the fixes were released, the PHP Foundation had not identified any working attack, and the researchers who tested the public proofs of concept found that each works only on a specific combination of system, version and server. But it only takes someone to build a more general technique, and many are trying, for the risk to multiply overnight.
A worldwide impact
The figures show the scale of the problem:
According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known. About a third of those sites still run PHP 7 or PHP 5, versions that no longer receive official updates.
On 22 October, Censys counted more than 3 million servers and about 56 million web properties running PHP visible on the internet, mostly in the United States, Germany and China.
On the day of the fixes, of the roughly 1.58 million servers that revealed their PHP version, about 1.57 million were still not updated.
These figures should be read with care. Linux distributions often fix PHP without changing the version number, so a server that looks vulnerable may already be protected, and the opposite also happens. Even so, with a wide margin of error, we are talking about millions of systems worldwide, including in Portugal.
The dangers of not updating now
A vulnerability like this is not a theoretical problem that can be scheduled for next quarter. Whoever postpones the update runs concrete risks:
Full control of the server: the attacker runs code with the web server's permissions and can read configuration files, database passwords and access keys to other services.
Theft of personal data: data about customers, patients or citizens can be copied, with notification duties under the GDPR and reputational damage that is hard to repair.
Back doors that stay: an attacker who gets in today can leave hidden files (web shells), scheduled tasks or new accounts that survive the update made tomorrow.
Ransomware and downtime: the compromised server can become a way in to encrypt internal systems or take them offline.
Use against others: compromised servers are used to send phishing, mine cryptocurrency or attack other organisations, with your address and your name attached.
Legal obligations: entities covered by the Portuguese Cybersecurity Legal Framework (Decree-Law no. 125/2025, which transposes the NIS2 Directive) must manage known vulnerabilities and notify significant incidents to the National Cybersecurity Centre.
Once the details of a critical flaw become public, the window between the fix and the attack is no longer measured in weeks. In this case, it was measured in minutes.
Automated attacks do not pick victims by size or profile: they sweep the whole internet looking for any vulnerable server. A small institutional website forgotten on an old server is as good a target as a large platform.
What to do now
Take stock. Identify every server, container and hosting service that runs PHP, including old websites, test environments and internal applications.
Update PHP to a fixed version (see the table) and restart every PHP process. On shared or managed hosting, confirm with the provider that the update has been applied.
Check the running version, not just the installed one: a process that has not been restarted is still vulnerable.
Look for signs of intrusion, especially on servers exposed since 17 October: new or changed PHP files, unknown scheduled tasks, new accounts and unusual outbound connections.
Plan the move away from unsupported versions. PHP 8.1 and earlier no longer receive official fixes, and PHP 8.2 stops receiving them on 31 December 2026.
| PHP version | Fixed version | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Active support |
| 8.4 | 8.4.27 | Active support |
| 8.3 | 8.3.36 | Security fixes only |
| 8.2 | 8.2.35 | Fixes end on 31 December 2026 |
| 8.1, 8.0 and 7.4 | No official release | Minimal source code fixes and packages from distributions or extended support vendors are available |
| 7.3 and earlier | No fix | Move to a supported version |
What if you cannot update today?
The PHP team lists measures that reduce exposure while the update is prepared, but it is clear that none of them makes an installation safe. The simplest is to disable upload progress in the server configuration, not in the application, and then restart every process:
session.upload_progress.enabled = 0Limiting the size of accepted requests (for example, a post_max_size of 8 MB where there are no file uploads) and blocking, at the front end, form requests with files on websites that do not use them also helps. These measures buy time; they do not replace the update.
Maintenance is security too
PHP2Shell is a reminder of an old rule: an information system is not finished on the day it goes live. It needs an inventory, regular updates, monitoring and someone who responds quickly when a critical flaw appears, including on the older websites and applications nobody remembers are still switched on.
At Datapoint, maintenance and support for the systems we develop include following these alerts and applying security fixes in a planned way. If you have systems in PHP and are not sure whether they are protected, get in touch.