PHP2Shell: the critical PHP vulnerability putting thousands of servers at risk

What happened?

Imagine you walk into an online store. You see the products, their prices, the shopping cart and the checkout button. But behind that page there is a server in charge of checking available products, verifying your account, calculating your order and talking to the database.

PHP is one of the programming languages that handle all that work you never see.

And it's far more common than it seems. According to W3Techs, around 70% of websites whose server-side language is known use PHP, including many built with WordPress: stores, digital newspapers, blogs and corporate sites.

In other words, you probably rely on PHP-based services every day without knowing it.

Where does the problem start?

We have to go back to 2024, when signs of a possible memory-related issue in PHP were first spotted. Specialists suspected it could be dangerous, but no one had yet shown how to exploit it to attack a server.

In August 2026, several security investigations, some assisted by AI tools, managed to identify ways to exploit vulnerabilities of this kind.

And what does that mean?

Imagine you own a store and every employee needs a password to enter the warehouse. But an attacker discovers a hole in the wall that lets them in without going through access control.

Something similar could happen with PHP: an attacker can send a specially crafted request and get the server to execute malicious instructions without ever logging in.

If the attack succeeds, it could access files, extract information, modify web pages or install malware, depending on the permissions and protections in place on the server.

What's concerning is that the flaw isn't necessarily in a company's website, but in PHP itself, the software the site runs on.

October: attack attempts begin

While the PHP team was preparing fixes, on October 17, Amazon's monitoring systems detected attempts to exploit the vulnerabilities on honeypot servers, built specifically to study attacker behavior.

On October 20, PHP announced an extraordinary security update, and finally, on October 21 it published patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.

Both received a severity score of 9.2 out of 10.

According to PHP's official advisory, the problem affects different types of servers running this language, particularly certain Apache configurations.

The disclosure of the flaws triggered a surge in attacker activity. Cloudflare logged tens of thousands of exploitation attempts in the first 45 minutes, rising to millions the following day.

Attempts to install a variant of the Mirai botnet, a type of malware used to control infected devices, were also detected.

But this doesn't mean millions of sites have been hacked. Attack attempts are one thing; actually gaining access to servers is another. Researchers cited by The Hacker News had not yet confirmed successful code execution in real attacks.

October 23: a third, lower-risk flaw appears

Two days after the emergency updates, PHP disclosed a third vulnerability, CVE-2026-115560.

This time the situation is different. The new flaw can only be exploited when an application uses a very unusual combination of session settings.

On top of that, servers that already have the session.upload_progress.enabled setting disabled are not exposed to this new attack vector. Nor are applications that never make the specific configuration change that causes the issue.

That's why PHP considers exploitation unlikely and hasn't released an emergency patch. Instead, it recommends keeping that setting disabled until the next regular update.

As of October 23, no confirmed attacks related to this third vulnerability had been reported, according to The Hacker News.

So what's the fix?

For the two initial critical flaws, PHP has already released the fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

The official PHP team stresses that updating is the only complete solution. Temporary measures can reduce some risk, but they don't replace the patches.

And here's the real challenge: it isn't enough for PHP to release an update. Every company, hosting provider or administrator has to install it on their own servers.

That's why this incident is a reminder of how important it is to keep systems updated, review configurations and monitor for potential threats.