PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. Their existence was publicly announced on 20 October 2026. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits could be used.
PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of websites.
Discovery
The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability. Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research.
PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible. A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized.
The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.
Patches
The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12). Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice. Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems.
The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released. One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure. Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an attempted stopgap mitigation against the vulnerability. Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day.
Impact
Warning posted on the English Wikipedia about community-owned tools being offline due to the PHP2Shell incident.
The potential impacts of the vulnerability were widespread. Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress. PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.
Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyber Security. The US National Security Agency recommended that websites go offline if unable to update immediately. The NCSC released a similar warning, urging organizations to be wary of backdoors. The Japanese National Cybersecurity Office advised PHP users to immediately update their systems. The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws.
Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used by about two-thirds of the web at the time. Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment. Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk. Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches.
12"Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI's most advanced models, during an audit of PHP's source code in August. ... Researchers from Google's Wiz cybersecurity team soon reached out with new exploits, which they had discovered independent of Calif."
↑"The class of bugs had been hiding in PHP's source code for years. A security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten, Duong said."
↑"News of the patch leaked out Tuesday, in a post to Hacker News, just under two days before the patch release."
↑"NSA Advisory: PHP Updates". NSA Press Room. 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026. Effective immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.
12著名ITサービス相次いで緊急メンテへ コドモン、シャドバ、BASE、さくらのレンタルサーバなど 「PHP」脆弱性に起因か[Several prominent IT services—including Codmon, Shadowverse, BASE, and Sakura Rental Server—have initiated emergency maintenance, likely due to a vulnerability in PHP] (in Japanese). ITmedia. 21 October 2026. Archived from the original on 21 October 2026. Retrieved 21 October 2026.
