What Is PHP2Shell? The Critical PHP Flaws That Took Websites Offline Worldwide: Who Is Affected and How to Fix It (2026)

1. What happened: the three days that took websites offline

PHP runs 69.3% of all websites whose server-side language can be identified (W3Techs, 22 October 2026), from WordPress, Joomla and Drupal to countless custom internal systems. When the PHP team gave advance notice on the night of 20 October that it would ship patches for "two critical vulnerabilities", and the CVE identifiers (Common Vulnerabilities and Exposures, the global reference numbers for security flaws) leaked ahead of schedule, agencies in several countries chose to take sites offline rather than wait.

2. What the two flaws are, explained without reading code

Both flaws live in the PHP engine itself, not in a plugin, a theme or your own code. Wiz, one of the discoverers, summarized it this way: a bare Hello World application on an affected PHP version can be exploited, and the application does not even need to use sessions.

Both carry the same CVSS (Common Vulnerability Scoring System, the standard severity scale) v4.0 score of 9.2 out of 10, rated Critical. The vector says network-reachable, no privileges, no user interaction, but "high complexity" because the attacker must line up memory to match each PHP version, build and web server. Wiz notes that AI models now adapt exploit code to each version far faster than before, and that a single researcher finished in a week what used to take a world-class team months. watchTowr scored the flaws 10.0 on its own scale.

3. Who is affected

3.1 Every version in over a decade, every setup that serves web requests

The affected range runs from PHP 5.4 (released 2012) through 8.5.11. The PHP team states that the risk applies to "all PHP installations serving web requests", whatever the SAPI (Server API, the interface a web server uses to call PHP). The level of risk differs by setup.

3.2 Software used by Thai organizations that has PHP inside

Many organizations say "we don't write PHP" while running it without knowing. This is the software written in PHP that shows up most often in Thai government agencies, universities and companies.

3.3 The size of the problem in numbers

• W3Techs (22 October 2026): PHP powers 69.3% of websites with a known language. Among PHP sites, PHP 7 still accounts for 26.9% and PHP 5 for 7.7%, so roughly one in three runs an end-of-life version with no official patch.
• Qualys (data from 12,000 customers): 167 million PHP installations found, 73% on internet-facing assets, and 71% of those with a known version on end-of-life branches (5.4 to 8.1). In the first 12 hours after disclosure only 199,000 installations had been patched.
• VirusTotal (via BleepingComputer): more than 5.1 million PHP hosts visible on the internet, about 3.8 million with at least one open port.

3.4 In Thailand

On 22 October 2026 Prof. Dr. Yodchanan Wongsawat, Deputy Prime Minister and Minister of Higher Education, Science, Research and Innovation (MHESI), ordered agencies under the ministry, especially universities, hospitals and medical schools, to act in three steps: (1) IT teams audit every website and system running PHP, starting with patient records and student databases, (2) enable interim protection such as a WAF (Web Application Firewall, a filter in front of the web server) and monitor for abnormal use, (3) test and upgrade PHP as soon as possible, because interim measures cannot replace fixing the software.

Paradorn Prisananantakul, Minister attached to the Prime Minister's Office and overseeing the NCSA (National Cyber Security Agency), directed ThaiCERT to act on four fronts: alert government agencies and critical infrastructure operators, assess the risk of internet-facing systems, monitor attack behaviour, and track remediation. No figures on affected Thai systems have been published, and no Thai agency has been confirmed breached.

For government agencies this follows directly from the NCSA Website Security standard in force since September 2026, which already requires software updates and vulnerability management, and it confirms the picture in our article on Thailand's above-average cyber threat level: anything internet-facing in Thailand is scanned around the clock.

4. How to fix it, in this order

Step 1: find every copy of PHP first

The command php -v only reports the PHP binary in your shell's PATH, which may not be the one serving web traffic (Qualys and Datadog both warn about this). Look at running processes, installed packages, and every container.

# Linux: which PHP processes are serving the web?
ps -eo pid,user,cmd | grep -E 'php-fpm|php-cgi|httpd|apache2|litespeed|frankenphp' | grep -v grep
# Is Apache loading mod_php?
apachectl -M 2>/dev/null | grep -i php
# Packages on Debian / Ubuntu
dpkg -l | grep -E '^ii\s+(php|libapache2-mod-php)'
# Packages on RHEL / Rocky / AlmaLinux
rpm -qa | grep -E '^php'
# Docker: images containing PHP
docker ps --format '{{.Names}} {{.Image}}' | grep -i php

Backported fixes from Linux vendors usually keep the old version number, for example 8.1.2 on Ubuntu 22.04. Check the package changelog for CVE-2026-109618 rather than trusting the version string alone.

apt changelog php8.1-fpm | head -30        # Debian / Ubuntu
rpm -q --changelog php-fpm | head -30      # RHEL family

Step 2: update, then restart every worker

PHP 8.2 itself reaches end of life on 31 December 2026, about two months away. If you are putting in the effort now, go straight to 8.3 or 8.4, which receive security fixes until the end of 2027 and 2028 respectively.

Step 3: if you cannot update this hour, the interim measures from the PHP team

; Example for the FPM php.ini, or as php_admin_value[...] in the pool (e.g. /etc/php/8.3/fpm/pool.d/www.conf)
memory_limit = -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_nesting_level = 16          ; tune to what the app needs; default is 64
session.upload_progress.enabled = 0
fatal_error_backtraces = 0            ; PHP 8.5 only
; then restart every worker
; systemctl restart php8.3-fpm apache2

Step 4: check whether you were already hit, back to 17 October

AWS advises starting the investigation from the first observed exploitation on 17 October, not from the patch date. These are the indicators published by Wiz, Datadog and AWS.

• PHP logs containing Allowed memory size of … bytes exhausted followed by Unknown on line 0 (memory ran out before application code started), and Apache logs with unusually frequent AH00052 … Segmentation fault (11)
• Upload-form POSTs containing the string PHP_SESSION_UPLOAD_PROGRESS at times when nobody was uploading files
• Form-urlencoded requests with a field name around 3.5 MB long, or binary data in a field with an empty name (make sure your WAF or proxy does not truncate large bodies before logging)
• Responses setting an unusually long or garbled PHPSESSID cookie, the signature of memory being read out
• Bursts of multipart requests followed by HTTP 500s, or workers being recycled far more often than usual
• The strongest signal: a PHP process (php-fpm, apache2 or httpd) spawning a shell (sh, bash), curl or wget, or new .php files appearing in the web root. A successful exploit may return HTTP 200 and leave the worker running, so status codes alone prove nothing

Memory exhaustion on its own does not mean you were attacked, and clean logs do not prove you were not (the PHP team says this outright). If you find the indicators above on a machine that was still unpatched, treat it as an incident: isolate the machine, rotate database passwords, API keys and any secret that lived in the worker's memory (the same advice China's MIIT gave its own agencies), and restore from a trusted backup. Our guide on rehearsing a restore so it actually works covers the mechanics.

5. Checklist for IT teams in Thailand

Compiled from CISA, the UK NCSC and the MHESI three-step order, in the order to do them.

6. Lessons bigger than PHP

A bug "nobody has exploited yet" is not a safe bug. The first flaw was visible in the 2024 audit, but PHP's consensus-based security team could not pick a fix, and the work stalled for over a year. The PHP Foundation itself calls this "a structural failure" and has moved to majority decisions, after creating an Ecosystem Security Team in May 2026. Any organization sitting on a "known vulnerability we haven't fixed because nobody has exploited it" should treat this as a mirror.

AI finds flaws faster than people, on both sides. Both discoverers, Calif (using OpenAI's GPT-5.6 Sol in the Patch the Planet program) and Wiz (Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas), used AI models to find the bugs and to write the exploits. The PHP team says Alpha-Omega and Anthropic's Claude Mythos scanned PHP earlier in 2026, and that it added OpenAI's Daybreak Red after the incident. This continues the story in our piece on the cyber-focused AI models from three labs: this time the defenders found it about two months ahead, but Wiz also admits the same tools adapt exploits to each version faster. The gap between a patch and real attacks keeps shrinking, as with Langflow, exploited within 20 hours.

The organizations that get through this week are the ones that know what they have and where. Not the ones with the most expensive firewall (some of which have PHP inside too). A complete inventory and a rehearsed patch process are what let a team answer a minister's order the same day. See our patch management lessons from the SharePoint flaw and the principles in data security in ERP systems, which apply to every system in the organization.

Conclusion

• PHP2Shell = CVE-2026-109618 (memory exhausted while the request is being set up) + CVE-2026-109619 (state left over between requests), both CVSS 9.2, unauthenticated remote code execution in the PHP runtime itself. Every application on PHP 5.4 through 8.5.11 is affected.
• Fixed releases: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (21 October 2026) · 7.4 / 8.0 / 8.1 get no official release and depend on Linux vendor backports or an upgrade.
• Highest risk is Apache mod_php (exploitable before application code runs), then PHP-FPM · firewalls and appliances with embedded PHP are affected too (Palo Alto PAN-OS confirmed).
• No broadly reliable public exploit yet (Rapid7, 22 October), but attempts began before disclosure (AWS, 17 October) and Cloudflare saw attacks before the patches shipped.
• Order of work: inventory → update and restart every worker → interim measures only where patching is impossible → review logs back to 17 October → report · PHP 8.2 is end of life on 31 December 2026, so plan to move to 8.3 or 8.4.

"A flaw at this level does not ask how well your code is written. It asks only two things: do you know where every copy of PHP is, and how many hours does it take you to update it?"

- Paitoon Butri, Network & Server Security Specialist, Grand Linux Solution

References

• PHP: PHP Security Release, 21 October 2026 (fixed versions and interim mitigations)
• PHP: Upcoming Critical PHP Security Release — advance notice, 20 October 2026
• GitHub Security Advisory GHSA-w8hw-w9fx-j79w — CVE-2026-109618 RCE via OOM corruption
• GitHub Security Advisory GHSA-6wmf-4rv5-p3rp — CVE-2026-109619 RCE via stale global state
• The PHP Foundation: Today's PHP security release and how we're strengthening PHP security (21 October 2026)
• PHP: Supported Versions (end-of-life dates for PHP 8.2–8.5)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026)
• NCSC (UK): Critical security issue affecting PHP (21 October 2026)
• Wiz Research: PHP2Shell — AI uncovers critical RCE vulnerabilities in PHP (21 October 2026)
• Rapid7: CVE-2026-109618 and CVE-2026-109619 — Critical Unauthenticated RCE in PHP (updated 22 October 2026)
• Google Cloud: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (22 October 2026)
• AWS Security Blog: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (22 October 2026)
• Qualys: Two Critical PHP Flaws Could Hand Attackers Your Web Servers — 167 million installations (updated 22 October 2026)
• Datadog Security Labs: PHP2Shell — detection, analysis, and remediation
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (21 October 2026)
• Help Net Security: PHP2Shell — Critical PHP vulnerabilities patched, update now (updated 22 October 2026 with Palo Alto / Fortinet / Cisco status)
• W3Techs: Usage statistics and market share of PHP for websites (22 October 2026)
• MGR Online (Thai): Critical PHP flaw shakes Asia — South Korea and China push updates, Japan suspends some services (22 October 2026)
• Bangkok Biz News (Thai): MHESI minister orders security upgrade after PHP flaw discovered (22 October 2026)
• T-News (Thai): Minister Paradorn orders all agencies to prepare — NCSA / ThaiCERT four-point response (22 October 2026)