Hackers are already trying to exploit PHP2Shell, two critical flaws in PHP, the programming language behind roughly 70% of websites, including those built on WordPress. The PHP project released emergency fixes on October 21. The US National Security Agency (NSA) has told organizations to install them immediately or take affected systems offline until they can.
Update: Exploit attempts have now reached the millions, and botnet operators have joined in. Separately, CYFIRMA tracked low-volume scanning from 21 hijacked machines against 216 unpatched hosts in several countries. It links that campaign to a North Korea-connected operator in the Lazarus Group orbit, with moderate confidence, and calls it scanning, not confirmed break-ins.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity.
What is PHP2Shell?
Both bugs allow unauthenticated remote code execution. In plain terms, an attacker can run their own code on a web server without logging in or needing a password.
According to the PHP project’s advisory:
- CVE-2026-109618 is a memory-handling bug. When PHP runs out of memory partway through a request, it can leave internal data half-built and then treat it as valid during cleanup.
- CVE-2026-109619 involves leftover data from a previous request. Memory that should have been cleared can be reused by the next request the same worker handles.
The NSA warns that flaws like these often give attackers a direct path into a server’s files or databases. That could mean stolen customer data, defaced pages or malware planted on a site.
Are hackers exploiting it?
Yes, attempts have started. Security firm watchTowr said on October 21 that it is seeing active exploitation attempts against both flaws. Cloudflare also reported early attack attempts before the patch went out. Public proof-of-concept exploits are now circulating online, though Rapid7 found they only work on specific combinations of PHP version, operating system and web server. Even so, on October 24 a researcher at Perplexity captured working attacks against honeypot servers, including one running PHP 8.4.26 with Apache mod_php, and Expel researcher Marcus Hutchins confirmed the finding, BleepingComputer reports. SecurityWeek counts 35 shells from two IP addresses across three honeypots, with no follow-up payload seen and no real-world victims named so far. On October 25, a researcher going by killa won a public PHP2Shell challenge on stealmybitcoin.com and posted the exploit on GitHub. It worked in about 7 of 10 lab runs, so a more dependable public exploit is now out there. A second GitHub exploit goes further and claims 10 successes in 10 tries against a stock official PHP image with default production settings, with no changes to display_errors or memory limits. That figure comes from the author’s own lab tests, and nobody has independently confirmed it. Still, the repository has already passed 1,000 stars. Amazon says its honeypots logged a first attack attempt on October 17, four days before the fix shipped.
The attacks picked up fast after the patch went public. Cloudflare saw tens of thousands of attempts within 45 minutes of the announcement and millions by October 22. Sophos also caught attackers trying to drop a Mirai-based botnet called Potassium, though its defenses blocked the payload.
Here’s the thing, though. Palo Alto Networks Unit 42 first linked an attack on a European government organization to these flaws. On October 25, it retracted that claim, saying it could not confirm the attackers got in through PHP2Shell. In that attack, which Unit 42 no longer ties to PHP2Shell, the attackers took password hashes and MFA secrets within two hours, set up an NTLM relay tunnel into Active Directory and tried to get Domain Admin rights. Unit 42 says the commands looked like an AI agent was running the attack. The public exploits are picky, and most attempts so far are scans. That could change quickly. VulnCheck has built a more reliable exploit that gets past a common memory protection, but it’s only sharing it with paying customers for now. Meanwhile, Censys still counts more than 34 million PHP services running vulnerable versions.
On October 26, CISA added both flaws to its Known Exploited Vulnerabilities list. US federal civilian agencies must patch them by October 29.
The disclosure was rushed. Details leaked online on October 20, a day before the planned announcement, which forced PHP to move its emergency release forward.
Which other products are affected?
The bugs also reach beyond websites. Palo Alto Networks says PAN-OS and Panorama are affected. As of October 25, it has released the first hotfixes (PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16), and fixes for the other versions are due between October 27 and 30, according to its updated advisory. Until then, it recommends its Threat Prevention signatures and locking down management access. The company says it has not seen attacks against its own products. On October 25, though, honeypot firm Defused Cyber reported PHP2Shell probes aimed at its decoy GlobalProtect systems, which are not real customer devices. Cisco has listed Expressway as affected, with a fix planned in version 15.5.21. Neither company has seen attacks on its products so far. Fortinet is checking 12 of its products and has pushed temporary virtual patches through FortiGuard in the meantime.
Which PHP versions are affected?
Almost every PHP version from 5.4 onward is affected. These versions contain the fixes:
| PHP branch | Update to |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older no longer get official updates. Qualys found that about 110 million PHP instances, roughly 71%, still run end-of-life versions from 5.4 to 8.1. The PHP security team has published basic source code fixes for 7.4, 8.0, and 8.1, but only for people who build PHP themselves. If you run PHP 5 or 7, the safest move is to upgrade to a supported PHP 8 version.
The flaws affect every common way of running PHP on a server, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says mod_php setups face the highest risk because the attack can be triggered before any website code even runs.
AI helped find the bugs
The flaws were discovered with the help of AI. Researchers from Wiz, security firm Calif and OpenAI’s Codex Security team found them using AI models, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. Calif’s work was part of OpenAI’s “Patch the Planet” program, which hunts for bugs in open-source software.
The researchers worked with the PHP team on the fixes before going public. Wiz has also warned that AI can cut both ways: now that the bugs are public, attackers can use AI tools to adapt exploits to different PHP versions much faster.
What should you do?
Not sure which PHP version your site uses? In WordPress, go to Tools → Site Health → Info → Server and look for “PHP version.” You can also find it in your hosting panel’s PHP settings or on the phpMyAdmin home page under “Web server.”
If you run your own server:
- Check your PHP version by running
php -vin the server terminal. - Update to one of the fixed versions above. Linux distributions received the patches in advance, so check your distro’s package updates first.
- If you can’t update right away, the NSA advises taking the server offline until you can.
- Check for signs of a break-in, such as unknown files in web folders, new user accounts or unexpected scheduled tasks.
PHP has also published temporary settings changes that reduce the risk. The project is clear that these do not replace updating. Two days after the PHP2Shell patches, PHP also warned of a separate remote code execution risk, CVE-2026-115560. It only affects apps with an unusual session setup: a site that switches session. serialize_handler to “php” at runtime while session upload progress is turned on. There is no emergency fix; PHP will patch it in its next routine release. Until then, setting session.upload_progress.enabled=0 blocks it, and sites that already applied that setting for CVE-2026-109619 don’t need to do anything more. No attacks on this new flaw have been reported. However, at least one public exploit toolkit on GitHub now includes a check for it, so there is little reason to wait for the next routine release before changing the setting.
If you run a WordPress site on shared or managed hosting:
WordPress says the flaws are in PHP itself, not in WordPress. That means the fix has to happen on the server. Most major hosts are rolling out patched PHP versions, and companies including Automattic, Cloudflare, AWS, and Microsoft tested the fixes before release. Check your PHP version using the steps above, or contact your host to confirm it has been updated.
The bottom line
PHP2Shell is one of the most serious web security issues of the year because PHP is everywhere. Attackers are already probing for unpatched servers, so if your site runs on PHP, update today.
New to web security? Read our guide on where to start with hands-on cyber security training.
Sources: PHP security advisory, NSA, watchTowr, The Hacker News, TechCrunch, SecurityWeek, The Hacker News on Unit 42 and CYFIRMA, Cyber Security News, Machine.news, Bleepingcomputer
