In October 2026, security researchers revealed two critical flaws in PHP, the programming language quietly running behind roughly 70% of the world's websites, that let attackers take over web servers without ever logging in. The pair of bugs, nicknamed PHP2Shell, prompted urgent warnings from the U.S. National Security Agency and CISA and revived a simple but important question: what exactly is a PHP vulnerability, and how does a flaw in a programming language put millions of websites at risk? This guide explains how PHP vulnerabilities work, breaks down the PHP2Shell discovery, and walks through the steps you can take to keep your own site safe.

What Is PHP, and Why Does It Run So Much of the Web?

PHP (originally short for Personal Home Page, now a recursive acronym for PHP: Hypertext Preprocessor) is a server-side scripting language created in 1994 by the Danish-Canadian programmer Rasmus Lerdorf. Unlike JavaScript, which runs inside a visitor's browser, PHP runs on the web server itself. When someone loads a page, the server's PHP engine processes the request, pulls data from a database, runs the application's logic, and generates the HTML that gets sent back to the browser.

That simple model turned PHP into the internet's quiet workhorse. According to W3Techs, PHP is used by roughly 69% of all websites whose server-side language is known. It powers WordPress (which itself runs a huge share of the web), Drupal, Joomla, and e-commerce platforms such as Magento, WooCommerce, and Shopware. Wikipedia runs on PHP too. Because so many sites depend on it, a flaw in PHP's core, rather than in one particular application, can ripple across the entire internet.

What Is a PHP Vulnerability, Exactly?

A PHP vulnerability is a weakness or bug that can be exploited to make a system behave in an unintended way. These weaknesses generally fall into two buckets. The first lives in application code: for example, a WordPress plugin that fails to sanitize user input can open the door to SQL injection or cross-site scripting. The second, more dangerous kind lives in the PHP engine itself, the software that interprets and runs PHP code. A flaw in the engine affects every website using that version, no matter how carefully each site was coded.

PHP2Shell belongs to that second category. It is a pair of memory-safety flaws in PHP's core that allow remote code execution, or RCE. In plain terms, RCE means an attacker can send a specially crafted request to a web server and trick it into running commands or software of the attacker's choosing, effectively taking control of the machine without a username or password.

Inside PHP2Shell: How the Two Flaws Work

PHP2Shell refers to two specific vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 on the CVSS 4.0 severity scale (the National Vulnerability Database scored them 9.8 under the older CVSS 3.1 system), placing them firmly in the critical category. They affect every PHP release from version 5.4 all the way up through 8.5.

  • CVE-2026-109618 (out-of-memory corruption): When PHP processes a request and runs out of memory, it must clean up and release the memory it was using. If that cleanup is interrupted at just the wrong moment, the engine can be left pointing at memory that has already been freed, a classic use-after-free bug. An attacker who crafts a request that triggers this failure at the right instant can corrupt memory in a way that lets them run their own code.
  • CVE-2026-109619 (stale global state): PHP keeps certain shared state while handling requests. In affected versions, that state was not always properly reset, allowing an attacker to manipulate leftover data to achieve code execution.

A key detail that made these bugs so serious is that the vulnerable processing happens in PHP's engine before a single line of a website's own code runs. The flaws are not caused by sloppy plugins or misconfigured sites; they sit in the foundation itself. Security researchers also noted the bugs could enable Heartbleed-style memory disclosure, potentially leaking sensitive data held in a server's memory in addition to enabling full remote control.

A Milestone: How AI Helped Find the Flaws

One of the most striking parts of the PHP2Shell story is how the bugs were uncovered. The discovery was led by researchers at Calif, a small U.S.-based cybersecurity firm, working alongside the cloud security company Wiz, and they did it with the help of cutting-edge artificial intelligence models, reportedly including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. The AI systems were used to analyze PHP's large codebase and flag memory-safety mistakes that human reviewers had missed for years, possibly decades.

The announcement drew wide attention in the tech world. OpenAI president Greg Brockman even noted that PHP was his first programming language. The episode is being framed as a landmark moment: AI tools are now being used to find and fix critical flaws in the infrastructure the internet runs on, though security experts also warn that the same tools could accelerate attackers.

Timeline: From Discovery to a Global Warning

The sequence of events moved quickly:

  • October 20, 2026: The PHP project announced a critical security release, signaling that major fixes were on the way.
  • October 21, 2026: PHP shipped patched versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) and published source backports for older, end-of-life branches including 7.4, 8.0, and 8.1.
  • Within days: The NSA advised organizations to take systems offline if they could not patch immediately, and CISA issued an alert urging immediate patching.
  • Late October 2026: Security researchers reported in-the-wild exploitation attempts, meaning attackers had already begun scanning for and attacking unpatched servers.

How to Protect Your Website From PHP Vulnerabilities

The single most important defense against PHP2Shell is simple: update PHP. Updating to a patched release (8.5.12, 8.4.27, 8.3.36, or 8.2.35) fixes both flaws, but the update must be followed by a restart of PHP processes, and a rebuild of any containers or server images, to take effect. If your site runs an older, unsupported version of PHP (8.1 or below, all the way back to 5.4), the safe path is to move to a supported branch or install a vendor package that backports the fixes.

Beyond patching this specific bug, the episode is a reminder of broader PHP security hygiene. To reduce your overall risk:

  • Keep PHP and all dependencies up to date, and run only supported versions.
  • Validate and sanitize every piece of user input before using it.
  • Use prepared statements with parameterized queries to prevent SQL injection.
  • Escape all output to prevent cross-site scripting (XSS) attacks.
  • Disable dangerous or unnecessary PHP functions in your php.ini configuration.
  • Configure error reporting carefully so sensitive details are never exposed to visitors.
  • Use a web application firewall (WAF) as an interim layer while patches are rolled out.
  • Remove diagnostic files such as phpinfo.php that reveal server details.

If you run a WordPress or other managed site, check with your hosting provider. Many hosts handle PHP updates automatically, but it is worth confirming that a patched version is actually in place.

Common PHP Vulnerabilities Beyond PHP2Shell

While PHP2Shell grabbed headlines because it lived in PHP's core, most day-to-day PHP security problems still come from how applications are written. The most common include:

  • SQL injection (SQLi): An attacker manipulates database queries by injecting malicious input, potentially reading or deleting data. Fixed with prepared statements and parameterized queries.
  • Cross-site scripting (XSS): An attacker injects JavaScript into a page that then runs in other users' browsers. Prevented by escaping output and validating input.
  • Cross-site request forgery (CSRF): A trick that makes a logged-in user's browser perform unwanted actions. Mitigated with anti-CSRF tokens.
  • File upload flaws: Attackers upload executable files that the server later runs. Prevented by strict file-type validation and storing uploads outside the web root.

The Bottom Line: Key Takeaways

  • PHP2Shell is a pair of critical memory-safety flaws (CVE-2026-109618 and CVE-2026-109619) in PHP's core that allow unauthenticated remote code execution.
  • The bugs affect PHP versions 5.4 through 8.5 and, because PHP powers roughly 70% of websites, put a large portion of the web at risk.
  • The flaws were discovered with the help of AI, a notable milestone for AI-assisted security research.
  • Patching to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (and restarting PHP) is the complete fix; the NSA and CISA urged immediate action.
  • Good long-term hygiene, including updating regularly, validating input, and using prepared statements, remains your best defense against PHP vulnerabilities in general.