In brief
Two critical flaws in PHP, nicknamed PHP2Shell, can let an attacker run their own code on a web server without logging in. The PHP project released fixes on October 21, 2026. Attacks are now confirmed, including against some security appliances. If you run anything built on PHP, update it.
What happened?
PHP powers a huge share of the web, from WordPress blogs to company portals. On October 21, the PHP project said versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. In plain terms: a stranger on the internet could take over the server.
The two bugs, CVE-2026-109618 and CVE-2026-109619, are both in how PHP handles memory during a request. PHP says the danger reaches all installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it rates the risk highest for mod_php, where a demonstrated attack fires before any website code runs.
Within days, attacks followed. The US cyber agency CISA added both flaws to its list of actively exploited vulnerabilities. Palo Alto Networks says they are being used against internet-exposed management interfaces on its PAN-OS firewalls, and one reported campaign chained them with a Linux kernel bug to gain root access.
What is confirmed?
- Patched versions are available, and PHP says only an update is a complete fix.
- The flaws are being exploited in the wild (CISA, via The Hacker News; Unit 42).
- The exposure is enormous. Unit 42 counted over 22.6 million exposed instances potentially vulnerable; Censys estimated more than 32.51 million PHP services still ran an affected version. The two counts use different methods.
What remains unknown?
- How many servers have actually been compromised so far.
- Who is behind the attacks, and whether they are targeting particular countries or sectors.
- How quickly hosting providers and older, unmaintained sites will patch.
Why it matters
Our reading: this is about as bad as web vulnerabilities get. No password needed, a huge installed base, and attacks already running. Many Indian businesses run on shared hosting or old PHP sites set up years ago by a freelancer and never touched since. Those are exactly the servers that won't patch themselves.
Older PHP is a particular worry. PHP says 8.1 and older no longer get updates from the project. If your site runs on one of those, the safe answer is an upgrade, or a vendor that still backports fixes.
What readers should do
- Run your own server? Update PHP now. Linux distributions received patches in advance, so your normal package update may already include them.
- Use shared hosting or a managed site? Ask your provider, in writing, whether PHP has been updated, and to which version.
- Run Palo Alto firewalls? Make sure the management interface is not reachable from the internet, and apply PAN-OS fixes.
- Can't update today? PHP lists temporary measures, but warns they reduce exposure without making an installation safe. Treat them as a stopgap measured in hours, not weeks.
- Check for signs of compromise: unexpected files in web folders, new admin accounts, or unfamiliar processes started by the web server.
Right of reply
This story relies on the PHP project's own security advisory and on Palo Alto Networks' published threat brief. We did not seek separate comment.