PHP websites: the PHP2Shell flaws are now being used in working attacks

On 21/10/2026 PHP, the language behind WordPress and many other websites, fixed two serious flaws known as PHP2Shell. They let an attacker take over a web server without logging in. Until now, no attack had been shown to work. That has changed: Adel Karimi at Perplexity recorded working attacks on decoy servers running an out-of-date PHP, and Marcus Hutchins at Expel backed up his evidence (BleepingComputer, 26/10/2026). On 26/10/2026 the US agency CISA added both flaws to its list of vulnerabilities known to be exploited.

If your website runs on WordPress, WooCommerce, Joomla, Drupal or another PHP system, yes, unless your host has already updated PHP. Some firewalls and control panels contain PHP too.

1. Email your host or web person today. Ask: "Which PHP version is our site on, and has it been updated for PHP2Shell?"
2. You want 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later on your version, or a patched package from your host's supplier.
3. On 8.1 or older? There are no new releases for these versions. CISA advises taking PHP systems on 8.1 or older offline until they can be patched or updated (26/10/2026), so ask your host about moving up now. PHP published small source fixes for 7.4, 8.0 and 8.1; ask whether one has been applied in the meantime.
4. Ask them to also apply the server setting PHP recommended on 23/10 for a related flaw that is not fixed yet.
5. If nobody can confirm a fix, the NCSC advises applying PHP's temporary settings and, if that would take too long, taking the site offline until it is fixed. If the site could not be updated straight away, have the server checked for signs of a break-in.

People using Ai. Calif and Wiz found the flaws, with OpenAI credited alongside them; people led the research and used Ai models as tools.

• CVEs and severity: CVE-2026-109618 (RCE via OOM corruption, GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (RCE via stale global state, GHSA-6wmf-4rv5-p3rp). Both rated CVSS v4.0 9.2 by the PHP security team (php.net, 20/10/2026). Descriptions here follow php.net; Wiz's blog maps its individual bugs to the CVEs differently, so go by the PHP advisories.
• Affected: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php highest risk, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs" (php.net). Earliest affected path is PHP 5.4.0, per Calif and Wiz.
• Fixed: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21/10/2026. Restart every worker after updating. PHP 8.2 reaches end of life on 31/12/2026 (php.net).
• 8.1 and older: no new releases from the PHP project. php.net: "Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version." The PHP security team also "provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor." These are source branches, not releases: PHP-7.4-CVE-2026-109618-109619, PHP-8.0-CVE-2026-109618-109619 and PHP-8.1-CVE-2026-109618-109619 in github.com/php/php-src.
• Partial mitigations (php.net, 21/10): they "reduce exposure to specific attack paths but do not make an installation safe". For CVE-2026-109618: memory_limit=-1 set where applications can't override it (for example php_admin_value), a low post_max_size (8M without uploads, 32M with), and container or cgroup limits (not RLIMIT_AS or RLIMIT_DATA). For CVE-2026-109619: session.upload_progress.enabled=0 in php.ini, an FPM pool or server config, then restart every worker (not ini_set() or .user.ini); on 8.5 also fatal_error_backtraces=0.
• CVE-2026-115560 (unpatched, still current as of 26/10/2026): announced by php.net on 23/10/2026 as "an unlikely RCE vector". It needs an app that sets session.serialize_handler to php_binary or php_serialize in config, then switches it to php at runtime with ini_set() before session_start(), with session upload progress still enabled. Workaround: session.upload_progress.enabled=0 until the next regular bugfix release, when PHP will publish the full advisory. No newer php.net advisory on these flaws has appeared since 23/10.
• Exploitation evidence: BleepingComputer (Sergiu Gatlan, 26/10/2026 09:19 GMT) reports that Adel Karimi, detection and response lead at Perplexity, recorded confirmed RCE on honeypots running Apache mod_php on PHP 8.4.26. Karimi, quoted by BleepingComputer: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process." Marcus Hutchins (Expel), in his own post on X (@MalwareTechBlog): "This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far." The chain used an oversized PHPSESSID cookie for memory disclosure, then an execution request. BleepingComputer notes earlier activity was "limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises" (quoting Dataminr's TRACE team). Wiz's suggested signals: unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, oversized or malformed PHPSESSID response cookies, and unexplained PHP worker churn.
• Status at the agencies (re-checked 27/10/2026): both CVEs were added to the CISA KEV catalogue on 26/10/2026 (catalogue version 2026.10.26, released 26/10/2026 22:24 GMT, US federal due date 29/10/2026). CISA revised its alert the same day: organisations that cannot update immediately, or that run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated". NCSC's alert (published 21/10, updated 23/10) has no exploitation update.
• Retraction to know about: Palo Alto Unit 42 linked an attack on a European government agency to PHP2Shell on 23/10, then withdrew that link on 25/10: "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs."
• Finders, in their own words: Calif (Ryan Austin) found the first bug on 01/08/2026 during OpenAI's Patch the Planet initiative: "I asked my LLM companion for help", and "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery." Wiz: "August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol." Wiz adds that "Frontier models were critical to making this process practical".

• php.net, security advisory and releases, 21/10/2026; Session upload progress advisory, 23/10/2026
• NCSC alert, 21/10/2026, updated 23/10/2026
• CISA alert, 21/10/2026, revised 26/10/2026
• CISA Known Exploited Vulnerabilities catalogue, version 2026.10.26, checked 27/10/2026
• Calif write-up and timeline, 21/10/2026
• Wiz, 21/10/2026
• BleepingComputer, exploited in the wild, 26/10/2026
• Unit 42 threat brief with retraction, updated 25/10/2026
• PHP 8.1 source backport branch, GitHub