Story ·

PHP2Shell: the flaw in the engine behind much of the web

PHP is the software engine behind a large share of the world’s websites, including WordPress, Drupal and Joomla sites. On 21 October its developers fixed two critical flaws that let an attacker take over a web server without logging in. Here is what that means, what CERT-In says, and what to do if you run a website.

By Threat Atlas India · Published 22 October 2026

The short version

  • What happened: two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. A specially crafted web request can let an attacker run their own code on the server.
  • Who is affected: any site whose PHP has not been updated. The flaw is in the engine, so it does not matter which website software runs on top of it.
  • The fix: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions get no official fix.
  • Attacks: early attacks have been reported since 21 October. How widespread they are is not yet known.

First, what PHP is

When you open a website, a program on the server builds the page you see. For a large share of websites, that program is written in PHP, and PHP itself runs it. WordPress, Drupal and Joomla, which run many government, university and company sites around the world, are all built on PHP.

Your browserAsks for a page
PHP on the serverRuns the site’s code. This is where the flaws are.
The websiteWordPress, Drupal, Joomla or custom code

Most security problems are in one website’s own code or in a plugin. This one is in the engine underneath, so every site running an unpatched PHP is exposed, whatever runs on top of it. According to Wiz, the security company that found the flaws, even a one-line “Hello World” page on an affected version can be attacked.

How it unfolded

  1. Found. Wiz says it discovered the first of the bugs, and by 21 August had shown a takeover of WordPress and Drupal sites. Wiz says AI models helped it find the flaws and build working attacks within hours.
  2. Reported. Wiz reports the flaws to PHP’s security team, which starts working on a coordinated fix.
  3. Early warning. The CVE numbers start circulating online. PHP announces an emergency security release for the next day, and CERT-EU, the EU institutions’ cyber security team, issues an advisory.
  4. The fix. PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare says it is “seeing early attacks emerging”, and watchTowr reports exploitation against its decoy servers.
  5. CERT-In. India’s cyber security agency issues vulnerability note CIVN-2026-0510, rated Critical, telling users to apply the updates.

What CERT-In says, and what it leaves out

CERT-In’s note lists the affected software as PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35. Those are the four versions PHP still supports, and the four that got a fix.

The note does not mention older versions. They are affected too. According to Wiz, nearly every PHP version released in the last decade, back to PHP 5.4, has at least one of the bugs. PHP published only minimal source-code patches for 7.4, 8.0 and 8.1, meant for people who build PHP themselves, and nothing for PHP 5. A reader who sees an old version missing from the list could take it to mean that version is safe. It means it is unpatched.

Was anyone attacked?

Early attacks: reported

Cloudflare said on 21 October that it was seeing early attacks and updating its protections as new methods appeared. watchTowr said its decoy servers had seen exploitation the same day.

How widespread: unknown

Huntress said that as of 7:30 pm India time on 21 October it had not seen attacks across the organisations it protects. The flaws were not yet on CISA’s list of vulnerabilities known to be exploited when we checked.

Code claiming to exploit these flaws is circulating online. Tenable warns that unverified exploit code may itself contain malware.

Read the advice like an analyst

“Change a setting” is a stopgap

Huntress suggests turning off one PHP setting, session.upload_progress.enabled, on old versions that cannot be updated, saying it blocks the known attacks. A PHP release manager replied to a similar suggestion that “ini settings won’t save you”. Treat it as a way to buy days, not as a fix.

A firewall helps only some sites

Cloudflare added rules against the known attacks, including on its free plan. It calls them a stopgap, and they only protect traffic that passes through Cloudflare. A server that can be reached directly is still exposed.

What to do

If you just use websites

  1. Nothing to install. This is a server problem. It is up to the people who run websites to fix it.

If you run a website, or someone runs one for you

  1. Find out your PHP version. In WordPress: Tools, then Site Health, then Info, then Server. On cPanel-style hosting: “Select PHP Version” or “MultiPHP Manager”. Or ask whoever built or hosts the site.
  2. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting, ask your provider today whether its PHP is patched, and when.
  3. If you are on PHP 8.1 or older, plan the upgrade now. Until then, ask your host about backported fixes, put the site behind a web application firewall, or take it offline, as the UK’s NCSC suggests for systems that cannot be fixed right away.
  4. Look for signs of a break-in if you were slow to patch: new or unfamiliar files in the website folder, new scheduled jobs, new admin accounts. If you find any, keep the server and PHP logs before cleaning up.

If you run IT for an organisation

  1. Count every copy of PHP you own, not just the main website: intranets, vendor appliances and control panels often carry their own.
  2. Patch internet-facing servers first, then internal ones.
  3. Stop announcing your version. Setting expose_php = Off does not fix anything, but it stops every visitor, including attackers, from reading your PHP version in the headers.

What we don’t know yet

  • How many attacks there have been, and whether any Indian organisation has been hit.
  • Whether Indian hosting providers have patched their shared servers.
  • Whether CERT-In will issue guidance for the older PHP versions its note does not list.

Sources

More stories

Vulnerabilities · 22 October 2026Patch week: GitLab, Node.js, Java and Plex, one by oneFour updates to check this week: a second CVSS 10 flaw in GitLab, Node.js and Java releases that both block the eMudhra certificates, and Plex flaws now being attacked. What each is, and what to update to.
Breaches · 22 October 2026Amagi Media Labs: an extortion claim, what is confirmed and what is only claimedBengaluru media-technology company Amagi told the stock exchanges that a threat actor is trying to extort it over stolen network data. What Amagi confirmed, what a ransomware group lists, and what is still unknown.
Supply chain · 22 October 2026LiteLLM 1.107.0: a trusted AI library shipped a password stealerA widely used open-source AI library had a release that steals credentials and opens a back door. What LiteLLM says happened, how to check if you were hit, and what to rotate.
All stories →