PHP2Shell Vulnerability: Critical Flaws in the PHP Engine Force Emergency Worldwide Patches

Web servers everywhere are racing to install emergency patches after two critical flaws in the PHP programming language leaked online under the nickname PHP2Shell. The flaws let attackers run code on a server without logging in — and because they sit in the PHP engine itself, even a perfectly written site is exposed to the PHP2Shell vulnerability.

PHP released emergency versions — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — on 21 October 2026, a day after the details leaked ahead of the planned 22 October disclosure. Attackers were already probing servers before the fixes went public, making this one of the most urgent PHP security update October 2026 stories in recent memory.

Leaked details forced a faster response

On 20 October 2026 the PHP security team posted an advance notice of an emergency release — and the details leaked that same day under the nickname PHP2Shell, well ahead of the coordinated disclosure planned for 22 October.

The PHP project shipped the patches on 21 October, alongside source backports for PHP 7.4, 8.0 and 8.1 — although no official releases were issued for those end-of-life branches.

Security researchers at Wiz found and reported the flaws — and The News reports that Wiz says artificial intelligence did the finding, using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz says it coordinated with the PHP team, OpenAI and the security firm Calif on the discovery. Cloudflare later reported early exploit attempts before the patches shipped. The security firm watchTowr reproduced the flaw independently, and the SANS Internet Storm Center raised its InfoCon alert level to yellow — a clear signal that real-world attacks are under way.

Two flaws deep inside the engine, not in your code

CVE-2026-109618 (advisory GHSA-w8hw-w9fx-j79w) causes remote code execution through out-of-memory corruption; CVE-2026-109619 (advisory GHSA-6wmf-4rv5-p3rp) allows it through stale global state.

Both flaws score 9.2 on the CVSS v4.0 scale — a CRITICAL rating. Readers should note this is not 10.0: a claim circulating online that the PHP2Shell vulnerability scored a perfect 10.0 came from an unsourced post and should be treated as misinformation.

Crucially, the attack needs no login: a single crafted request demonstrated the exploit against Apache’s mod_php. Attackers can also read worker memory, potentially exposing passwords, tokens, API keys and certificates from other requests — on shared hosting, one customer’s secrets could be exposed through an attack on another site on the same server.

Nearly every PHP version back to PHP 5.4 is affected, and every common way of serving PHP is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Even a plain “Hello World” page on a vulnerable build can be targeted.

Why the PHP2Shell vulnerability matters for Pakistan

PHP is the backbone of WordPress, Drupal and Joomla — the platforms behind a huge share of Pakistani blogs, business websites and freelance projects. That makes the PHP2Shell vulnerability a direct concern for Pakistani freelancers, bloggers, small businesses and shared-hosting customers.

Check which PHP version your site actually runs and ask your host whether patched builds are available — on shared hosting, the provider controls the PHP build.

The News reported on 22 October that government websites in Europe and elsewhere were taken offline as a precaution — including the Dutch cybersecurity agency, Finland’s state IT provider Valtori and France’s Interior Ministry, with Wikipedia also pulling down systems until they could be patched. No Pakistani government sites have been reported offline, but the worldwide scramble is a reminder for local site owners to treat patching as urgent rather than optional.

Freelancers should check every client’s PHP setup, not just their own. No public evidence has linked the flaws to any specific Pakistani company or server — treat any such claim with scepticism unless it comes from an official source.

How to check and update

Patching is the only complete fix for the PHP2Shell vulnerability. Disabling PHP’s session upload progress feature reduces the risk but does not fully remove it.

Follow these steps:

1. Find the real PHP version. php -v on the command line is not enough — it only shows the command-line build, which can differ from the version serving your website. Check your hosting panel, ask your host, or use a temporary phpinfo() test file and delete it afterwards.

2. Assume you are affected if any PHP from 5.4 onwards serves your site’s web requests.

3. Ask your hosting provider for a patched build — the PHP emergency patch 8.4.27 for the widely used 8.4 branch, or 8.5.12, 8.3.36 and 8.2.35 for the others.

4. On your own servers or Docker containers, rebuild from patched base images rather than simply restarting the old ones.

5. On PHP 7.4, 8.0 or 8.1, look for the official source backports — but plan an upgrade, as these branches get no official releases.

Attacks are already under way

With exploit attempts reported before the patches shipped, defenders have no head start. SANS raising InfoCon to yellow tells administrators to expect a wave of scanning now that disclosure is public.

A web application firewall can add emergency rules as a stopgap, but that is a delaying tactic, not a cure. The only real answer to the PHP2Shell vulnerability is a patched PHP build.

The PHP2Shell vulnerability is a reminder that the software underneath a website matters as much as the website itself. Update now — and verify the serving binary, not just the command line.

Related reading on UrduPro: our roundup of the best free AI tools of 2026 for developers, and our guide to ChatGPT’s features and pricing in 2026.

Sources: AWS security blog: using AWS WAF to apply mitigations for the PHP2Shell RCE vulnerabilities; dev.to explainer: PHP2Shell — two critical PHP runtime flaws give unauthenticated attackers code execution.