PHP2Shell vulnerability enables remote code execution on millions of websites. The PHP Foundation has released urgent patches, but updating remains a challenge. The fix was published on October 21, 2026.

The PHP2Shell vulnerability allows remote code execution on PHP servers, affecting versions 8.2 to 8.5 that had not received patches as of October 30, 2026. The PHP Foundation released urgent patches to fix two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hackers are already exploiting the flaws, leading some large companies to temporarily take their websites offline. France is among the most affected countries, with 2 million unpatched services. CISA added the vulnerabilities to its KEV catalog, urging immediate updates.

Illustration of the letters PHP with cracks in them.
Image: spectrum.ieee.org

The vulnerability was reported in 2024 and exploited by a team from California with the help of AI. Whether updating is possible depends on the PHP version and on the availability of patches in Brazil, which has not been confirmed. The information was revealed by sources such as Failles PHP, the PHP Foundation and CISA.

PHP faces criticism for delays in fixing flaws

The PHP2Shell vulnerability emerged amid growing tension over web server security. The organization warned that the fix required a specific combination of configurations and application code, which made rapid deployment difficult. According to Failles PHP, 29.6 million PHP services were still exposed on October 30, even after the patches were published. The situation reflects a global challenge: even when patches are released, many servers remain unpatched. CISA also warned about the risk, reinforcing the need for urgent action.

The vulnerability was not just an isolated discovery — PHP had already been warned about a third flaw but did not prioritize the fix, which drew criticism. PHP's slow response highlights the complexity of keeping open-source systems secure at scale. The vulnerability was identified in 2024 and exploited by a team from Calif with the help of AI, affecting millions of websites around the world.

With information from wired.com, next.ink and techradar.com.

Sources

  1. This is not a drill 2 php vulnerabilities are setting the internet on firewired.com
  2. Failles php2shell on a scanne tout le fr 250 000 sites affichent un php vulnerablenext.ink
  3. Php releases emergency fixes as some of the worlds biggest websites say they were targeted by hackerstechradar.com
  4. Failles php onze jours apres pres de 30 millions de sites et services web toujours vulnerables01net.com
  5. Ai in cybersecurity php2shell vulnerabilityspectrum.ieee.org

Text written with AI from the sources listed and checked by the newsroom's automated rules. How we work

Want to see resumer first in Google searches?

Add to Google's preferred sources