PHP2Shell is the name being used for two critical vulnerabilities in PHP's core engine: CVE-2026-109618 and CVE-2026-109619. The official PHP advisories describe memory-handling flaws that, under particular request and worker conditions, can lead to unauthenticated remote code execution (RCE). The PHP team rates each vulnerability 9.2 out of 10 under CVSS v4.0. These are PHP runtime flaws, not vulnerabilities limited to WordPress or another individual website application.
Who is affected?
The PHP team says web-facing PHP installations are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team identifies mod_php as the highest-risk configuration; other setups should not assume they are safe. Wiz demonstrated RCE against current WordPress, Drupal and Joomla images, but the issue is in PHP itself and can affect other PHP applications too. The NCSC advises organisations to identify PHP systems across their infrastructure, including internet-facing services and products that bundle PHP.
The scale matters, but the headline percentage needs context. Wiz describes PHP2Shell as affecting “70% of the Internet”; W3Techs currently measures PHP on 69.3% of websites whose server-side language it can identify. Those figures describe PHP's prevalence, not a verified count of vulnerable or compromised sites. BleepingComputer also reported that Cloudflare had observed early attack traffic, so exposed systems should be treated as urgent. The Hacker News discussion is useful for seeing community reactions, but PHP's advisories remain the source for affected versions and fixes.
Recommendations
Patch the PHP runtime as soon as possible. PHP's fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Update every web-facing installation, including containers, hosting accounts and bundled software, then restart or replace workers as required by your hosting provider. If you run an older branch, check with your operating-system or hosting vendor for a backported fix, or plan an upgrade to a supported PHP release. PHP 8.1 and older no longer receive updates directly from the PHP project.
If you cannot patch immediately, follow the PHP team's temporary mitigation guidance and restart affected workers. The PHP team and NCSC warn that temporary measures do not fully remove the risk; if you cannot update or mitigate an exposed system promptly, consider taking it offline. A WAF rule is not a replacement for a PHP security update.
Guidance and sources
- PHP security advisory: technical details, fixed releases and temporary mitigations.
- Wiz Research's PHP2Shell analysis: research findings and demonstrated application impact.
- BleepingComputer's patch report: release details and administrator guidance.
- CISA Known Exploited Vulnerabilities Catalog: a useful prioritisation feed; check its current entries rather than assuming these CVEs are listed.
- OWASP guidance on vulnerable and outdated components: inventory software, monitor advisories and keep components supported.