Skip to content
Oasis Web Services

Security · 5 min read

PHP2Shell: What the Big PHP Security Flaw Means for Your Website

Oasis Web Services

A cracked PHP badge with a plaster on it, beside web servers and a shield with a tick

On 21 October 2026, a lot of websites around the world suddenly started showing error pages. It wasn't a coordinated protest by the internet's servers. It was PHP2Shell, the most serious security flaw found in PHP in years, and site owners everywhere were taking their sites offline to patch it.

If your website runs on WordPress, or was built by a developer more than a few years ago, there is a good chance it runs on PHP. Here is what happened, in plain English, and what you should do about it.

What is PHP, and why should I care?

PHP is the programming language behind a huge share of the web. WordPress, Drupal, Joomla and Magento all run on it, and it comes bundled with the control panels most shared hosting companies use, such as cPanel and Plesk. Researchers at Censys counted about 2.58 million internet-facing servers running PHP, hosting tens of millions of websites.

You may never have chosen PHP. It is often just there, quietly doing its job underneath your site, like the plumbing in a rented flat.

What is PHP2Shell?

PHP2Shell is the nickname for two linked flaws in the core of PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical, scoring 9.2 out of 10 on the industry's standard severity scale.

In simple terms, both flaws are about PHP getting confused over memory:

  • One happens when PHP runs out of memory partway through handling a visitor's request, and then treats half-finished data as if it were complete.
  • The other leaves bits of information from one visitor's request lying around after they should have been cleared away, where a later request can pick them up.

Put the two together and an attacker can, in the worst case, take control of the server, without needing a password or a login. Security firm Wiz warned that attackers would most likely use it to install "web shells": hidden control panels that let them come back and do whatever they like.

How it unfolded

The timeline reads like a thriller, if thrillers had more changelogs:

  • August 2026: researchers found the flaws with the help of AI models. Wiz credits a mix of AI tools with helping it turn a long-standing bug into a working attack, which is both impressive and slightly alarming.
  • 17 October: the first attempt to exploit the flaw was spotted, four days before it was made public.
  • 20 October: details leaked early, including a demonstration video that was released by mistake.
  • 21 October: the PHP project released fixed versions, and attacks were already being seen in the wild.

Some organisations, including government websites in Europe and Canada, went offline deliberately to patch, following advice from security agencies such as the UK's National Cyber Security Centre. Wikimedia, the Internet Archive and others briefly switched services off too. In other words, if you saw an unusual number of "service unavailable" pages that week, that was the internet changing its locks.

What you should do now

1. Find out whether your site uses PHP

If your site runs on WordPress, Drupal, Joomla, Magento or most shared hosting, the answer is yes. If you are not sure, ask your developer or hosting company. It is a quick question for them to answer.

2. Make sure PHP has been updated

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later. Ask your host, in writing, which PHP version is serving your website and when it was patched.

One catch worth knowing: the PHP version shown in your hosting control panel is not always the one actually serving your pages. Ask them to confirm the live version, not the setting.

3. Get off old versions of PHP

If your site runs PHP 8.1 or older, there is no official fix from the PHP project. Google's guidance is to update to PHP 8.2 or newer. Older sites sometimes need a little work to run on a newer version, so this is a job for your developer, not a button to press on a Friday afternoon.

4. Make sure the update is actually running

Installing the update is not quite enough. The web server needs to restart so it stops using the old, vulnerable version in memory. Good hosts do this automatically, but it is worth asking.

5. Use a firewall as a safety net, not a fix

Cloudflare added protection against PHP2Shell for all its customers, including those on free plans, and called it a stopgap. A web application firewall can block many attacks while you update, but updating is the only real fix.

6. Watch for signs of trouble

New admin users you didn't create, files you don't recognise, unexpected redirects or a sudden slowdown can all be signs that someone got in before the patch. If you spot any of these, talk to your developer before simply updating, as they may need to check what happened first.

What this teaches us

PHP2Shell is a reminder that every website sits on layers of software someone has to keep up to date. You don't need to understand memory allocation. You just need to know who is responsible for updates, and to be confident they actually happen.

Three questions to ask whoever looks after your website:

  • Who applies security updates, and how quickly?
  • How would we know if the site had been hacked?
  • When did you last test restoring a backup?

For the longer version, our guide to website hosting and security covers what good hosting should include.

How we can help

This website, for the record, doesn't run on PHP at all. We build modern sites that serve pre-built pages from a fast global network, which means far fewer moving parts for attackers to poke at.

If you are not sure whether your site was affected, or you would like someone to take updates off your plate, our maintenance and support service covers it. Get in touch and we will take a look.

Sources

Keep reading

Related articles.

All articles