PHP2Shell explained, what the PHP vulnerability means for you

MacWindowsiPhoneAndroidUpdated

PHP2Shell is the name given to two critical security flaws in PHP, CVE-2026-109618 and CVE-2026-109619, which the PHP project fixed on 21 October 2026. PHP is a programming language that a great many websites run on. The UK's National Cyber Security Centre (NCSC) says the flaws may allow attackers to run commands on web servers that use it. This guide is accurate as of 23 October 2026.

Quick answer

PHP2Shell is two critical flaws in PHP, the language behind many websites. They're fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. If you run a website, check and update its PHP version. If you own a NAS or router, check the maker's advice. If you only visit websites, the fix is the site owner's job.

What is PHP2Shell?

It's two separate bugs in PHP itself, announced together. The PHP project's advisory describes them as remote code execution flaws, meaning someone could make a server run their own instructions. The US Cybersecurity and Infrastructure Security Agency (CISA), which calls them "php2shell", says they allow this without the attacker needing to log in. Both are rated 9.2 on version 4 of the CVSS severity scale, and the PHP project calls them critical.

PHP's own site describes the language as "especially suited to web development". It runs on the server that sends you a web page, not on your phone or laptop. The PHP advisory says the flaws affect all PHP installations serving web requests, and that it considers the risk highest for Apache with mod_php, where it has a demonstrated exploit.

Which PHP versions fix it?

The PHP project released four fixed versions on 21 October 2026:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

The release notes say "There are no complete mitigations, updating is the only safe choice."

PHP 8.1 and older no longer get updates from the PHP project. Its advisory says some distributions and long-term support vendors provide backported fixes, and that you should contact your vendor or move to a supported version. Given how serious the flaws are, the PHP security team also published minimal source backports for PHP 7.4, 8.0 and 8.1, which matter to people who build PHP themselves.

Who is affected among ordinary people?

Most people will never touch PHP directly. Where it reaches personal users is in three places.

You own or look after a website. A blog, a small shop or a club site on WordPress or similar may well run on PHP. The NCSC says organisations using any version of PHP are affected. Start with how to check your website's PHP version, then how to update PHP on WordPress. If something already looks wrong, read website hacked: what to do.

You own a NAS, a router or another home device with a web admin page. CISA says PHP can be bundled inside other software and may not be easy to spot, and the NCSC tells organisations to watch for updates from vendors whose appliances and services bundle PHP. Our guide to PHP2Shell on Synology and QNAP NAS drives covers what those makers have said. If you're wondering about your own computer, see does PHP2Shell affect my Mac?

You visit websites or shop online. The flaws are in servers, so fixing them is the site owner's job. Two other questions come up a lot: can visiting a hacked website hack you? and is my personal data at risk?

What does "attempts reported" mean?

As of 23 October 2026, the official sources say this. CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". CERT-EU, the cybersecurity service for EU institutions, says early proofs of concept have begun to circulate, which it says raises the likelihood that attackers are already exploiting the flaws. QNAP's advisory of 22 October says exploitation attempts against PHP have been publicly reported. Germany's Federal Office for Information Security (BSI) said on 22 October that it was not yet aware of widespread successful exploitation, but that reports of exploitation attempts, before the fixes came out and more often since, show that attacks, including automated ones, are being attempted.

An attempt is someone sending the attack to a server to see if it works. A report of attempts doesn't tell you that any particular website was broken into, and it doesn't mean your data was taken. The PHP project's own advice is that updating is the only safe choice.

What should I do now?

It depends which of the three groups you're in.

If you run a website:

  1. Find out which PHP version your site uses. How to check your website's PHP version shows how.
  2. Update to one of the fixed versions, or ask your hosting company whether it already has. The NCSC tells organisations to update internet-facing systems first.
  3. If you can't update straight away, the NCSC suggests the PHP project's temporary mitigations, and taking the system offline if those can't be applied quickly. CISA also says to take PHP systems offline if they can't be updated right away or run PHP 8.1 or older.
  4. If you can't update or take the site offline straight away, the NCSC says to check it for signs of compromise and backdoors.

If you own a NAS, router or similar device, check the manufacturer's security advisory for your model and install any update it offers.

If you're a visitor or customer, you don't need to install anything because of PHP2Shell. The NCSC's general advice still applies: use a strong, separate password for your email and turn on 2-step verification. The NCSC also warns that criminals exploit high-profile data breaches while they're in the news, so be wary of any message that asks you to log in or click a link.

Is there a third PHP vulnerability?

There's a related but much smaller one. On 23 October the PHP project published an informational advisory about CVE-2026-115560. It says the problem can only occur under an unusual combination of settings and code, and that this setup is unlikely in practice. Its interim advice is to turn off session upload progress until the next regular bugfix release.

More questions

Is PHP2Shell a virus?

No. It's the name for two flaws in PHP, the software many web servers use. A flaw is a weakness that could be used to attack a server. The fix is an update to PHP, which the server's owner or hosting company installs, not something you scan your own device for.

Do I need to update PHP on my computer?

Probably not. PHP runs on web servers, and the PHP advisory says the flaws affect installations serving web requests. If you've installed PHP yourself to build websites, update it. Our guide on PHP2Shell and the Mac goes into this.

What does CVSS 9.2 mean?

CVSS is a scoring system for how severe a security flaw is. The PHP project rates both PHP2Shell flaws 9.2 under CVSS version 4, and its advisory classes them as critical. CERT-EU, the NCSC and CISA all treat them as critical too.

My website is on shared hosting. Is it my job to update PHP?

Ask your hosting company whether it has installed the fixed PHP versions, and check which version your own site is set to use. The NCSC's advice to organisations is to update to the latest PHP version, internet-facing systems first. How to check your website's PHP version shows where to look.

Has anyone been hacked with PHP2Shell?

As of 23 October 2026, CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". None of the official advisories listed below gives a number of compromised sites.

What is PHP 8.1 end of life?

PHP 8.1 and older no longer receive updates from the PHP project, so no official fixed release exists for them. The project published minimal source backports for 7.4, 8.0 and 8.1, and says to contact your vendor or move to a supported version.

Sources

All PHP2Shell guides