> ## Content Index > Fetch the complete content index at: https://thecyberstories.com/llms.txt > Use this file to discover other available public pages before exploring further. # PHP2Shell: two critical PHP flaws are being exploited. Patch now - URL: https://thecyberstories.com/php2shell-critical-php-flaws/ - Published: 2026-11-03T04:07:25.000Z - Updated: 2026-11-03T04:07:25.000Z - Description: Two critical flaws in PHP, the language behind most websites, can let attackers run code on a server without logging in. Patches came out on October 21, 2026, and attacks are now confirmed. Here is who is at risk and what to do. - Author: Raja Sekhar Thota - Tags: Incidents, #csv-6ae95df698469f5b53b1a634, #Import 2026-11-03 21:46 ## In brief Two critical flaws in PHP, nicknamed PHP2Shell, can let an attacker run their own code on a web server without logging in. The PHP project released fixes on October 21, 2026\. Attacks are now confirmed, including against some security appliances. If you run anything built on PHP, update it. ## What happened? PHP powers a huge share of the web, from WordPress blogs to company portals. On October 21, the PHP project said versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [fix two critical vulnerabilities that can allow unauthenticated remote code execution](https://www.php.net/archive/2026.php?ref=thecyberstories.com). In plain terms: a stranger on the internet could take over the server. The two bugs, CVE-2026-109618 and CVE-2026-109619, are both in how PHP handles memory during a request. PHP says the danger reaches [all installations serving web requests, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed](https://www.php.net/archive/2026.php?ref=thecyberstories.com), and it rates the risk [highest for mod\_php](https://www.php.net/archive/2026.php?ref=thecyberstories.com), where a demonstrated attack fires before any website code runs. Within days, attacks followed. The US cyber agency CISA [added both flaws to its list of actively exploited vulnerabilities](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html?ref=thecyberstories.com). Palo Alto Networks says they are being used against [internet-exposed management interfaces on its PAN-OS firewalls](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?ref=thecyberstories.com), and one reported campaign [chained them with a Linux kernel bug to gain root access](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?ref=thecyberstories.com). ## What is confirmed? - Patched versions are available, and PHP says [only an update is a complete fix](https://www.php.net/archive/2026.php?ref=thecyberstories.com). - The flaws are being exploited in the wild ([CISA, via The Hacker News](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html?ref=thecyberstories.com); [Unit 42](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?ref=thecyberstories.com)). - The exposure is enormous. Unit 42 counted [over 22.6 million exposed instances potentially vulnerable](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?ref=thecyberstories.com); Censys estimated [more than 32.51 million PHP services](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html?ref=thecyberstories.com) still ran an affected version. The two counts use different methods. ## What remains unknown? - How many servers have actually been compromised so far. - Who is behind the attacks, and whether they are targeting particular countries or sectors. - How quickly hosting providers and older, unmaintained sites will patch. ## Why it matters Our reading: this is about as bad as web vulnerabilities get. No password needed, a huge installed base, and attacks already running. Many Indian businesses run on shared hosting or old PHP sites set up years ago by a freelancer and never touched since. Those are exactly the servers that won't patch themselves. Older PHP is a particular worry. PHP says [8.1 and older no longer get updates from the project](https://www.php.net/archive/2026.php?ref=thecyberstories.com). If your site runs on one of those, the safe answer is an upgrade, or a vendor that still backports fixes. ## What readers should do - **Run your own server?** Update PHP now. [Linux distributions received patches in advance](https://www.php.net/archive/2026.php?ref=thecyberstories.com), so your normal package update may already include them. - **Use shared hosting or a managed site?** Ask your provider, in writing, whether PHP has been updated, and to which version. - **Run Palo Alto firewalls?** Make sure the management interface is not reachable from the internet, and apply PAN-OS fixes. - **Can't update today?** PHP lists temporary measures, but warns they [reduce exposure without making an installation safe](https://www.php.net/archive/2026.php?ref=thecyberstories.com). Treat them as a stopgap measured in hours, not weeks. - **Check for signs of compromise:** unexpected files in web folders, new admin accounts, or unfamiliar processes started by the web server. ## Right of reply This story relies on the PHP project's own security advisory and on Palo Alto Networks' published threat brief. We did not seek separate comment. ## Sources - [Security advisory: critical remote code execution vulnerabilities, update now (PHP, October 21, 2026)](https://www.php.net/archive/2026.php?ref=thecyberstories.com) - [CISA confirms active exploitation of two PHP2Shell flaws (The Hacker News, October 2026)](https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html?ref=thecyberstories.com) - [Threat brief: critical vulnerabilities in PHP (Unit 42, Palo Alto Networks, updated October 29, 2026)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?ref=thecyberstories.com)