Two critical PHP vulnerabilities, known as PHP2Shell, could expose millions of websites to cyberattacks. Security experts have issued urgent warnings as developers release emergency fixes for affected servers.
Security researchers have uncovered two critical vulnerabilities in PHP that could allow hackers to take control of affected web servers without passwords, prompting emergency updates and warnings from cybersecurity authorities.
Two serious security vulnerabilities have been discovered in PHP, the programming language used to power a substantial portion of the internet, raising concerns about the safety of websites, online businesses and digital services worldwide.
The flaws, collectively named PHP2Shell, could allow attackers to execute malicious code on vulnerable servers without needing a username or password.
Both vulnerabilities have received a critical severity rating of 9.2 out of 10, according to the PHP development team and the European Union's Computer Emergency Response Team, CERT-EU.
Emergency patches were released on Wednesday, 21 October, with developers urging organisations to update their systems immediately.
The warning is particularly significant because PHP is used by popular website platforms, including WordPress, Drupal and Joomla, as well as numerous custom-built business applications.
The vulnerabilities exist within PHP itself rather than any particular website platform, potentially exposing different types of websites that rely on affected installations.
How the vulnerabilities were discovered
The flaws were identified by researchers at cloud security company Wiz, which disclosed them to PHP's security team in August.
According to a research timeline published by Wiz, the first vulnerability was discovered on 19 August 2026.
Researchers subsequently demonstrated that the weakness could be exploited against Drupal and WordPress installations before privately reporting their findings to the PHP development team on 24 August.
The vulnerabilities remained undisclosed to the public while security fixes were being developed.
On 20 October, PHP's security team issued an advance notice about an emergency security release scheduled for the following day.
The patches were published on 21 October alongside technical details of the weaknesses.
The coordinated disclosure was intended to give software maintainers and hosting providers an opportunity to prepare before the vulnerabilities became widely known.
What makes PHP2Shell dangerous?
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect how PHP manages computer memory while processing requests.
Under normal circumstances, a web server receives information from a visitor, processes it and returns the requested content.
However, researchers discovered that certain errors could cause PHP to mishandle memory and potentially allow attackers to influence the server's behaviour.
One vulnerability involves memory corruption during the handling of out-of-memory errors. The second concerns internal data that remains accessible after the memory storing it has been released.
These weaknesses could allow attackers to execute code remotely, a type of security breach known as remote code execution.
In practical terms, successful exploitation could enable a hacker to interfere with a website, access information available to the affected process or install malicious software.
Wiz researchers also identified the potential for sensitive information to be exposed through memory disclosure.
The risk is particularly serious because attacks may be possible without the hacker first signing into the affected website.
In its security advisory, the PHP development team warned that web-facing installations were at risk, including those using common deployment methods such as PHP-FPM, Apache's mod_php and LiteSpeed.
The team identified Apache installations using mod_php as presenting particularly high risk, citing a demonstrated attack that could be triggered by a single unauthenticated request before application code begins running.
Why WordPress and other websites could be affected
PHP is a central component of many popular content management systems.
WordPress, which powers websites ranging from personal blogs to major commercial publications, confirmed on 21 October that the vulnerabilities affect PHP rather than WordPress itself.
This means installing the latest WordPress update is not enough to resolve the problem if the server continues running a vulnerable version of PHP.
In a security announcement, WordPress urged website owners to check their PHP installations and apply the relevant updates.
The organisation said no WordPress-specific update was required or planned for the vulnerabilities.
The same underlying risk extends to other platforms and applications built with PHP.
For example, a business may have updated its website software, secured its administrator accounts and removed outdated plugins, yet still be exposed because of the PHP runtime installed on its hosting server.
That makes the issue particularly relevant to organisations relying on shared hosting, managed servers and third-party website providers.
However, the fact that a website uses PHP does not necessarily mean it is currently vulnerable. Its exposure depends on the installed version, whether security fixes have been applied and how the server is configured.
Which PHP versions need updating?
The PHP development team released four patched versions on 21 October to address the vulnerabilities.
The affected versions and corresponding security releases are:
PHP versionSecurity updatePHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35
Installations running earlier releases within these branches should be updated.
Older PHP branches, including PHP 8.1 and earlier, are no longer supported by the PHP project's regular security maintenance programme.
Organisations using older versions may therefore need to migrate to a supported release or obtain a verified, vendor-maintained security fix.
The PHP team has stressed that temporary protections cannot completely eliminate the vulnerabilities.
Its official advisory states that installing the security updates is the only complete remediation.
Artificial intelligence played a role in the discovery
The research has also highlighted the increasing role of artificial intelligence in identifying software vulnerabilities.
Wiz said its team used several AI tools during the investigation, including Wiz Atlas, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.
Google Cloud separately confirmed that Gemini 4 Argon contributed to the discovery, exploit research, attack detection and validation of the security patches.
The findings demonstrate how AI-assisted security research can uncover complicated weaknesses in widely used software.
Such vulnerabilities can remain undetected for years because identifying them may require examining unusual interactions between different parts of a program.
AI tools can help researchers analyse large amounts of software code and investigate potential weaknesses more efficiently.
But the development also presents a challenge for the cybersecurity industry.
As these capabilities become more accessible, attackers may attempt to use similar techniques to search for vulnerabilities and develop exploits.
The PHP2Shell discovery illustrates how artificial intelligence could accelerate both defensive security research and the potential development of new cyber threats.
Is there evidence of widespread attacks?
The disclosure of the vulnerabilities has raised concerns about exploitation, particularly because technical demonstrations have become publicly available.
CERT-EU has warned that the availability of exploit information increases the potential danger to organisations that have not installed the patches.
However, the ability to exploit a vulnerability does not necessarily mean attackers have successfully compromised large numbers of websites.
As of 23 October, the official sources reviewed for this report do not establish a verified global total of compromised servers or affected organisations.
The number of installations still running vulnerable PHP versions is also uncertain.
Security researchers have demonstrated that successful exploitation is technically possible, but determining the scale of real-world attacks requires separate evidence.
For website owners, the absence of a confirmed large-scale breach should not be interpreted as proof that their systems are safe.
Once vulnerabilities become public, attackers can attempt to identify exposed servers and exploit organisations that have been slow to apply security updates.
What does this mean for businesses?
The vulnerabilities have implications for businesses that depend on websites and web applications to provide services to customers.
An online retailer, for example, may rely on PHP to operate its product catalogue, customer accounts or parts of its payment process.
A successful server compromise could potentially disrupt those services or expose information accessible to the affected system.
Similar risks apply to educational platforms, booking services, company websites and internal business applications.
For smaller organisations, identifying and resolving the problem may be especially challenging if they do not have dedicated technical staff.
Many businesses rely on hosting providers to manage the underlying software powering their websites.
In those cases, responsibility for applying server-level PHP updates may rest with the provider rather than the website owner.
Nevertheless, organisations should confirm that the fixes have been deployed instead of assuming the issue has already been resolved.
Google Cloud has also warned that customers running vulnerable PHP applications on its infrastructure may be affected, even though Google said its own cloud services were not vulnerable to the disclosed flaws.
This distinction reinforces an important aspect of cloud security: using a major cloud provider does not automatically protect customers from vulnerabilities in the software they choose to deploy.
What should website owners do now?
The immediate recommendation from PHP developers and cybersecurity authorities is to update affected installations.
Website owners and administrators should first establish which PHP version their systems are running.
For WordPress websites, this information can usually be found in the administration dashboard under Tools, Site Health, Info and Server.
Those using managed hosting services should contact their providers to confirm whether the patches have been installed.
Administrators responsible for their own servers should update to the appropriate security release, test their applications and verify that the updated runtime is being used.
Organisations should also review relevant security logs for unusual activity and investigate any suspected compromise.
For systems that cannot be updated immediately, CERT-EU recommends considering temporary isolation from public networks.
Additional controls may reduce exposure to particular attack methods, but they are not considered complete alternatives to patching.
Businesses should also maintain reliable backups and ensure that server processes have only the permissions necessary to perform their intended functions.
For ordinary internet users, the vulnerabilities do not generally require changes to personal devices simply because they visit websites using PHP.
The responsibility for installing the fixes lies primarily with the organisations operating the affected servers.
A reminder of the internet's shared security risks
The discovery highlights the extent to which modern digital services depend on common software technologies.
PHP has been developed and maintained for decades, allowing businesses and developers to build websites without creating every underlying component from the beginning.
That shared foundation has helped make web development more accessible.
But it also means vulnerabilities in a widely used component can affect many otherwise unrelated applications.
The incident does not establish that PHP is inherently unsafe. Security weaknesses can emerge in any sufficiently complex software system, including mature and extensively tested technologies.
What matters is how quickly vulnerabilities are discovered, disclosed and resolved.
In this case, researchers privately reported the issues, PHP maintainers developed patches and cybersecurity authorities issued public warnings.
Attention has now shifted to website operators and hosting providers, whose response will determine how long vulnerable systems remain exposed.
With working demonstrations of the flaws publicly documented and official fixes available, organisations still running affected PHP installations face an avoidable security risk.
