Two newly disclosed PHP security flaws could allow attackers to execute malicious code on vulnerable servers without logging in. Website owners are being urged to update their PHP installations immediately.

Published: 22 October 2026
Category: Cybersecurity, Web Development, Technology News

A Major PHP Security Warning for Website Owners

A serious cybersecurity alert has emerged following the disclosure of two critical vulnerabilities in PHP, one of the most widely used programming languages for websites and web applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been associated with the name PHP2Shell. Security researchers warn that these flaws could allow remote attackers to execute malicious code on vulnerable servers without requiring authentication.

PHP is used across a substantial portion of the internet, including websites built with popular content management systems such as WordPress, Drupal and Joomla. This widespread adoption means that a vulnerability in the PHP engine itself could have consequences far beyond a single website platform.

According to research published by Wiz on 21 October 2026, the newly identified flaws affect PHP installations across a broad range of versions. The PHP development team has released security updates, and administrators are being advised to assess their systems and patch affected installations as quickly as possible.

What Is PHP2Shell?

PHP2Shell is the name associated with the two critical PHP vulnerabilities disclosed in October 2026. Unlike security issues limited to a particular WordPress plugin or website theme, these vulnerabilities affect the PHP runtime itself.

PHP processes application logic on web servers, handles requests and helps websites communicate with databases and other services. When a flaw exists in this underlying runtime, an attacker may be able to exploit it before normal application-level protections can take effect.

The vulnerabilities involve problems in PHP’s handling of memory during error conditions and request processing. Under certain circumstances, these flaws can leave internal memory in an unsafe state, potentially allowing an attacker to execute arbitrary code.

Security researchers have reported remote code execution scenarios that do not require an attacker to authenticate first. Successful exploitation could give an attacker a path to compromise a server, access sensitive information, alter website content or deploy malicious software.

The precise impact depends on the PHP configuration, server architecture, application behaviour and privileges available to the affected PHP process.

The Two Critical Vulnerabilities Explained

1. CVE-2026-109618: Remote Code Execution Through Memory Corruption

The first vulnerability involves PHP’s handling of out-of-memory conditions.

When a program runs out of available memory, it must handle the failure safely. In the affected PHP code, an error-handling path can interrupt normal processing while internal request data is only partially initialised.

Subsequent cleanup operations may then interact with invalid internal data. Researchers warn that this behaviour can potentially be abused to achieve remote code execution.

For website owners, the danger is that a carefully crafted request may trigger a vulnerability in the PHP runtime rather than a conventional weakness in the website’s login system or application code.

2. CVE-2026-109619: Remote Code Execution Through Stale Memory State

The second vulnerability involves stale internal state and memory that has already been released.

In certain circumstances, PHP may retain a reference to request-related memory after that memory has been freed. If a later operation uses this stale state before it is correctly reset, the resulting behaviour may create an opportunity for code execution.

This is particularly concerning in environments where PHP workers process multiple requests over their lifetime. The vulnerability demonstrates why correct memory management and safe error handling are essential for server-side software.

Both vulnerabilities have been rated critical, with a reported CVSS v4.0 score of 9.2. They should therefore be treated as urgent security issues rather than routine maintenance updates.

Does This Affect 70% of the World’s Websites?

The widely circulated 70% figure refers to PHP’s reported reach across the web. It should not be interpreted as evidence that 70% of all websites are vulnerable, compromised or actively under attack.

The distinction is important: PHP’s popularity creates a large potential exposure, but actual risk depends on whether a website runs an affected PHP build, whether its configuration is susceptible, and whether the appropriate security patches have been applied.

Nevertheless, the PHP2Shell disclosure is significant because the vulnerabilities affect the underlying runtime rather than one individual plugin or content management system.

Websites using WordPress, Drupal, Joomla and custom PHP applications should not assume that they are protected simply because their application software is updated. The PHP version installed on the server must also be checked.

Furthermore, PHP may be bundled inside hosting environments, security appliances and other software products. Organisations should therefore review their wider infrastructure, not just their main website.

Which PHP Versions Are Affected?

The PHP security advisory published on 21 October 2026 identifies fixed releases for the following supported branches:

The PHP project states that the vulnerabilities affect a broad range of older versions, including versions dating back to PHP 5.4. PHP 8.1 and earlier no longer receive regular security updates from the PHP project, although some operating-system vendors may provide backported fixes.

Important: Administrators should consult the official PHP security advisory and their operating-system or hosting provider to determine the correct fixed package for their environment. Installing a patched version from the wrong source or changing PHP versions without compatibility testing can cause application problems.

What Could Happen If a Website Remains Vulnerable?

If an attacker successfully exploits a vulnerable PHP installation, the consequences may extend beyond a temporary website outage.

Potential risks include:

• Unauthorised server access: Attackers may execute code with the privileges available to the vulnerable PHP process.
• Data theft: Customer information, application secrets and other accessible files could be exposed.
• Website defacement: Malicious actors may modify website pages or publish unauthorised content.
• Malware deployment: A compromised server could be used to host malicious files or redirect visitors.
• Business disruption: Attackers may cause service interruptions, damage customer trust or interfere with normal operations.
• Further compromise: A vulnerable server may provide a foothold for attempts to access other systems, depending on network permissions and security controls.

These are potential outcomes, not proof that every vulnerable website has experienced an attack. However, the possibility of unauthenticated remote code execution makes prompt remediation essential.

How to Protect Your Website From PHP2Shell

Website owners, developers and hosting administrators should take the following steps.

1. Check Your Current PHP Version

Identify the PHP version used by every production website and application. Check the hosting control panel, server configuration or command-line environment as appropriate.

Remember that a server may host multiple websites using different PHP versions. Check each relevant runtime rather than relying on a single version displayed in a control panel.

2. Install the Appropriate Security Update

Upgrade to the applicable security-fixed PHP release or the corresponding patched package supplied by your operating-system vendor.

For managed hosting, contact the hosting provider and ask whether the affected PHP runtime has been patched. Confirm that the update applies to the actual environment serving your website.

3. Restart the Relevant Services

After updating PHP, follow the vendor’s instructions for restarting or reloading PHP-FPM, web-server modules, application workers and any other affected services. A package update alone may not ensure that every running worker is using the corrected code.

4. Review Your Website’s Security

Check that WordPress, Drupal, Joomla, plugins, themes and custom applications are fully updated. Remove unused extensions and ensure that administrative accounts use strong authentication.

These steps are valuable layers of defence, but application updates alone do not replace patching the vulnerable PHP runtime.

5. Review Server Logs and Monitor for Suspicious Activity

Examine web-server, PHP and security logs for unusual requests, unexpected errors, abnormal process behaviour or unexplained file changes.

If there is evidence of successful exploitation, treat the incident as a potential server compromise. Preserve relevant logs, investigate affected systems, rotate exposed credentials and secrets from a clean environment, and seek qualified incident-response assistance where necessary.

6. Apply Temporary Mitigations Where Patching Is Delayed

If an immediate update is impossible, follow the official PHP advisory and your security provider’s guidance for temporary mitigation. Network filtering, request limits and disabling affected features may reduce certain attack paths, but they should not be treated as complete protection.

Where a publicly exposed system cannot be secured promptly, consider isolating it from the internet until remediation is possible.

Is a Web Application Firewall Enough?

A web application firewall (WAF) can provide an additional layer of protection by filtering suspicious requests. Security providers have also published guidance and protections in response to the PHP2Shell disclosure.

However, a WAF is not a substitute for a security-fixed PHP installation. Attack techniques can change, configurations vary, and not every exploit path is necessarily blocked by a filtering rule.

The most reliable response is to patch the underlying runtime, verify the fix is active, monitor for signs of compromise and maintain layered security controls.

What Website Owners Should Do Now

The PHP2Shell disclosure is a reminder that website security depends on more than a secure theme, a strong password or an updated plugin. The software that processes every incoming request must also be maintained.

Businesses should prioritise internet-facing PHP systems, confirm their versions, coordinate with hosting providers and apply the appropriate security updates. Developers should review deployment pipelines and ensure that staging and production environments use supported, patched releases.

Organisations running legacy PHP versions should treat this incident as an opportunity to plan a supported upgrade path. Older software can carry additional security and compatibility risks, particularly when regular upstream security fixes are no longer available.

Final Thoughts

PHP remains an essential part of the modern web, powering websites, content management systems and business applications worldwide. Its widespread use also means that serious flaws in the PHP runtime deserve immediate attention.

The two PHP2Shell vulnerabilities—CVE-2026-109618 and CVE-2026-109619—highlight the potential consequences of memory-management weaknesses in server-side software. While the claim that 70% of websites are vulnerable should not be repeated as an established fact, the breadth of PHP’s adoption makes this a significant security alert.

The key action is straightforward: check your PHP version, install the appropriate security fix and verify that your production environment is protected.

For website owners, developers and businesses, proactive patching is one of the most effective ways to reduce the risk of a preventable security incident.

Official References

• PHP security advisory and fixed releases: https://www.php.net/
• UK National Cyber Security Centre alert: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
• European Union Agency for Cybersecurity (ENISA): https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities
• Wiz Research’s PHP2Shell analysis: https://www.wiz.io/blog/php2shell-php-rce

Disclaimer: This article provides general cybersecurity information and is not a substitute for a technical assessment of an individual server or application.