What Happens If Your Website Isn’t Patched Against php2shell? PHP Flaw Explained

What happens if your website is not patched against php2shell? This week, security agencies in the US and Europe sent the same urgent message: update PHP now. Two critical flaws, nicknamed php2shell, can let an attacker run code on a web server without logging in. PHP also powers WordPress and many other sites, so the warning reaches far beyond IT teams. Here is a plain-English explainer.

What was announced about php2shell

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two flaws tracked as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation said the flaws, “under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP.” It urged everyone running PHP to update right away.

On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately. In addition, a joint statement from the European Commission, ENISA, CERT-EU and Europol’s cybercrime center gave the same advice. According to CERT-EU, both flaws score 9.2 out of 10 for severity.

How the php2shell flaws work

You do not need to code to understand the basic idea. Both bugs sit in parts of PHP that almost every web request touches. Specifically, they involve memory handling and error handling.

• CVE-2026-109618 (out-of-memory bug): A request can hit PHP’s memory limit at exactly the wrong moment. PHP may then leave half-built internal data behind and later treat it as valid. As a result, an attacker can shape that leftover memory to take control.
• CVE-2026-109619 (stale state bug): After certain fatal errors, PHP can keep a pointer to memory from an earlier request. Then a later request on the same worker may use that freed memory. Attackers can abuse this to run code, too.

The most worrying detail involves Apache with mod_php. On those servers, a single request without a login can trigger the attack before any website code runs, the PHP Foundation says. In other words, a WordPress site with every plugin up to date could still face risk if the PHP version underneath is old.

What happens if a site is not patched against php2shell?

“Remote code execution” is the most serious type of web flaw. Essentially, it hands an attacker the keys to the server. If someone exploits php2shell on an unpatched site, the results could include:

• Website takeover: Attackers can change pages, add spam links or send visitors to scam sites.
• Hidden backdoors: A “web shell” lets the attacker return later, even after you fix the original bug.
• Data theft: Attackers can copy database passwords, user accounts, customer details and email lists.
• Malware and crypto-mining: Criminals can use the server to mine cryptocurrency, send spam or attack other systems.
• Ransomware: Attackers can lock files and databases and demand payment to restore them.
• SEO damage: Search engines and browsers may flag a hacked site as dangerous. Consequently, traffic can collapse until the owner cleans it up.

Not every unpatched server will fall victim. The real risk also depends on how each server runs PHP. Still, the window for “wait and see” is closing fast.

Are attackers already using php2shell?

Reports keep changing. In its October 21 alert, CISA said it had not yet seen attacks at the time it published. However, CERT-EU noted that technical details were already public. It added that early proof-of-concept code had begun to circulate, which raises the chance of attacks.

Since then, the picture has darkened. Security firm Tenable reports that Amazon’s threat intelligence team saw an exploit attempt on October 17. That was four days before public disclosure. Tenable also says attackers now exploit php2shell broadly in the wild. So website owners should assume criminals are scanning for weak servers.

Who is at risk from php2shell?

According to CERT-EU, every PHP setup that serves web requests faces risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. These PHP versions need an update:

• 8.5.x versions below 8.5.12
• 8.4.x versions below 8.4.27
• 8.3.x versions below 8.3.36
• 8.2.x versions below 8.2.35
• 8.1 and older, which no longer get official releases

That covers blogs, online stores, school portals and many business tools. Some of them use PHP in the background, and their owners may not even know it. For this reason, ENISA points organizations to a list of products that embed PHP, kept by the Dutch national cyber security center (NCSC-NL).

How to protect your site from php2shell

Based on guidance from CISA, CERT-EU and the PHP project, here is a simple checklist:

1. Check your PHP version. In WordPress, go to Tools > Site Health > Info > Server. Your hosting control panel will also show it.
2. Update to a fixed version. Choose 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Alternatively, ask your host to confirm they applied the patched packages.
3. Restart PHP workers after the update, so no old process keeps running.
4. Upgrade old versions. If you run PHP 8.1 or older, plan an upgrade now. Until then, CISA advises taking unpatched systems offline.
5. Add a web application firewall. CISA says a firewall “may provide some protection.” But only an update fully fixes the problem.
6. Look for signs of a break-in. Watch for unknown admin users, strange PHP files, odd redirects, or PHP processes that launch shells or download tools.
7. Keep backups off the server, so you can restore a clean copy if needed.

What php2shell means for everyday internet users

If you just browse the web, you cannot patch other people’s servers. Even so, you can lower your own risk. First, use a unique password for each site, so one breach does not unlock others. Next, turn on two-factor login. Finally, be careful if a familiar site suddenly redirects you or asks you to download something.

Curious how fast tech risks can grow? Read our explainer on what happens if AI becomes smarter than humans.

The bottom line

If a PHP website stays unpatched against php2shell, an attacker may take over the server with a single request. They could then steal data, plant malware and damage the site’s reputation. Fortunately, the fix already exists. For most owners, it simply means updating PHP or checking that their host did. Details about attacks are still developing, so we will update this article as agencies share new guidance.

Sources: PHP Foundation, CISA, CERT-EU, ENISA, Tenable. Information accurate as of October 23, 2026.