What is PHP2Shell? Critical PHP flaws put millions of websites on emergency patch alert

Millions of websites running PHP are facing a major security threat after researchers uncovered two critical vulnerabilities that could allow hackers to take control of affected servers. The flaws, collectively called PHP2Shell, were publicly disclosed on October 21, 2026. Both carry a critical severity score of 9.2 out of 10, prompting urgent warnings from cybersecurity agencies and website hosting companies worldwide.

The problem is so serious that even the Prime Minister of Japan has tweeted about this. PHP runs behind the scenes on a huge number of websites, including those using WordPress, Drupal and Joomla. Attackers could exploit vulnerable installations without knowing a password. Emergency patches are now available, but website administrators need to install them quickly. Cloudflare has already reported early attacks targeting the vulnerabilities.

皆様に、今夜に対応して頂きたい大至急のお願いです。

多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。

公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。

修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。

国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

— 高市早苗 (@takaichi_sanae) October 21, 2026

:

PHP2Shell is the name given to two security flaws identified as CVE-2026-109618 and CVE-2026-109619.

Both involve problems with how PHP manages computer memory. Under certain conditions, attackers can send specially prepared requests that cause the server to behave unexpectedly.

The result could be remote code execution, which means hackers may run commands on a vulnerable server without logging in.

Think of a website as a shop with a locked entrance. PHP2Shell could give attackers a way to interfere with operations inside, even without a key.

:

Which PHP versions are affected?

The PHP security team released emergency updates on October 21.

Older unsupported PHP installations remain a particular concern.

:

OpenAI says its AI-assisted security initiative, Patch the Planet, helped researchers identify critical weaknesses in PHP.

Researcher Calif identified a flaw using GPT-5.6 Sol. Cybersecurity company Wiz independently discovered and reported both vulnerabilities.

The PHP maintainers led the patching effort, supported by security researchers and infrastructure providers including Cloudflare.

:

Website administrators should check their PHP version and install the appropriate security update immediately.

OpenAI has published a that can help identify potentially outdated installations. Its results are limited by the version information a server exposes, so an unclear result cannot confirm safety.

For vulnerable websites, updating PHP remains the only complete fix. Administrators should check server logs for suspicious activity, particularly if their systems were exposed before patching.

:

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

— FBI Cyber Division (@FBICyberDiv) October 21, 2026

FAQs

1. What is PHP2Shell?

PHP2Shell refers to two critical PHP vulnerabilities that may allow attackers to execute malicious commands on affected servers.

2. Can PHP2Shell affect WordPress websites?

Yes. WordPress websites running vulnerable PHP versions may be affected, even if WordPress itself is updated.

3. Is PHP2Shell being exploited by hackers?

Cloudflare reported early attacks around the public disclosure. The full scale of successful exploitation remains unclear.

4. Is there a fix for PHP2Shell?

Yes. PHP released patched versions on October 21, 2026. Website administrators should upgrade or obtain verified vendor patches.

5. Can a PHP2Shell checker fix my website?

No. A checker can help identify potentially vulnerable PHP versions. Applying the correct security update requires action by the website owner or hosting provider.