A pair of critical security flaws in PHP, the programming language behind a large share of the world's websites, has sent governments and companies scrambling. The bugs, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to run code on a web server without any password or account. Emergency patches were released on Wednesday, October 21, and several European governments took public websites offline as a precaution.

If you run a website, blog, online store or app backend on PHP, this is one update you should not postpone.

What exactly is PHP2Shell?

PHP2Shell is the name given to two memory-handling bugs inside the PHP engine itself, not in any single app or plugin. Both have been rated 9.2 out of 10, which puts them firmly in the "critical" bracket.

  • CVE-2026-109618: When PHP runs out of memory mid-request, some request data can be left half-initialised. The clean-up process may then treat that broken data as valid, leading to memory corruption.
  • CVE-2026-109619: Internal state belonging to one request can survive after its memory has been freed, and a later request handled by the same worker may use that stale data.

Under the right conditions, attackers can chain this into unauthenticated remote code execution, effectively taking control of the server. Europe's CERT-EU says a demonstrated exploit needs only a single request, and it can fire before the website's own code even runs. Setups using Apache with mod_php are considered the most exposed, but PHP-FPM servers are also affected.

Which PHP versions are affected and which are safe

All releases in the currently supported branches before the latest patches are vulnerable. PHP 8.1 and older versions no longer receive official updates, which makes them a bigger worry.

PHP branchUpdate to (fixed version)
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35
PHP 8.1 and olderEnd of life; upgrade, or use a vendor/distro backport
Severity9.2 (Critical) for both CVEs
Patch releasedOctober 21, 2026

Governments pull websites offline

The response in Europe was swift. Agencies in the Netherlands, Finland and France took government websites or services offline as a precaution, and Denmark's municipal IT company shut several services, including a national school communication platform. In Australia, several government websites, including the national cyber security portal cyber.gov.au, reported outages, and the Australian Signals Directorate urged PHP users to apply patches.

Cybersecurity agencies in the UK, Europe, Australia and Japan issued alerts, and the UK's National Cyber Security Centre told organisations to consider taking systems offline if they could not patch or apply mitigations quickly. Cloudflare said it was pushing firewall rules to block attacks, but its CTO stressed that this was only a stopgap and that patching was the real fix.

Found with the help of AI, leaked early

Researchers say artificial intelligence tools helped uncover how the weakness could be exploited. Details then began circulating online on October 20, before the fixes were ready. The PHP team had planned to release patches on October 22, but brought them forward by a day after the information got out. Security experts now warn that proof-of-concept code is circulating and some systems may already have been targeted.

Why it matters for Indian websites

PHP powers a huge number of Indian sites, from WordPress news blogs and small business pages to college portals, e-commerce stores and government department websites. Many are on shared hosting, where the PHP version is controlled by the hosting company, and many still run old versions that are past end of life. That combination makes India a large potential target.

What site owners should do right now

  1. Check your PHP version. On cPanel or similar hosting panels, look under "Select PHP Version" or "MultiPHP Manager". WordPress users can find it under Tools, Site Health, Info, Server.
  2. Update to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35). If you are on a VPS, update through your Linux distribution's packages or build from source.
  3. Ask your host. If you are on shared hosting, contact support and confirm the patched version is live on your server.
  4. Restart PHP workers after the update so old processes are not left running.
  5. Apply temporary mitigations only if you cannot patch immediately. CERT-EU lists steps such as disabling session upload progress and tightening request size limits, but warns these do not make a server fully safe.
  6. Look for signs of compromise. Check for unknown admin users, unfamiliar files and odd outbound traffic, especially if your server stayed unpatched for days.

Updating WordPress plugins or themes will not fix this flaw, because the bug sits in the PHP engine underneath them.

What happens next

Expect a wave of advisories from software vendors whose products bundle PHP, and automated scanning by attackers looking for unpatched servers. For most site owners, the fix is a version upgrade that takes minutes. The risk of skipping it is far bigger.

Also Read