PHP developers have released emergency security updates to fix two critical vulnerabilities that could allow unauthenticated attackers to execute malicious code on vulnerable web servers.
Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws are collectively known as PHP2Shell and have a severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system.
The vulnerabilities affect the PHP runtime itself, meaning websites could remain exposed even if their applications are properly secured. PHP is widely used to power websites and web applications, including WordPress sites, online stores and other internet-facing services. Security researchers have warned that successful exploitation could allow attackers to execute commands with the privileges of the affected web server process and potentially access sensitive information stored in memory.
The PHP security team has released fixes for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators are strongly advised to install the appropriate security update as soon as possible. The vulnerabilities affect multiple PHP execution environments, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Systems running Apache with mod_php face particularly high risk because an unauthenticated request can trigger an exploit before the application code begins executing.
Researchers have also demonstrated that the flaws could expose sensitive data held in PHP worker memory. Depending on the circumstances, this information could include authentication tokens, API keys, passwords and certificates associated with other requests. The security implications extend beyond individual websites because an attacker who compromises a server may be able to access resources available to the compromised process.
The vulnerabilities were discovered by researchers from Wiz, Calif and OpenAI, who worked with the PHP security team and other researchers to develop fixes. According to the researchers, the underlying weaknesses had existed in PHP for more than a decade. Artificial intelligence tools also helped researchers investigate the flaws and develop working exploits, highlighting how AI-assisted security research can accelerate the discovery of vulnerabilities in widely used software.
Reports of the vulnerabilities surfaced before their originally planned public disclosure, prompting PHP to bring forward its emergency security release. Cloudflare reported early attempts to exploit the flaws and deployed temporary protective measures while urging administrators to patch affected systems. However, reports of attempted exploitation do not necessarily mean that a particular website has been successfully compromised.
The security issues have also prompted organizations to take precautionary measures. Several government and public-facing services in Europe were temporarily taken offline while administrators assessed their exposure and prepared security updates. These shutdowns were intended to reduce potential risks rather than confirm that the affected organizations had suffered successful attacks.
Website owners should remember that updating WordPress, a theme or a plugin does not automatically fix vulnerabilities in the underlying PHP runtime. Administrators must update the PHP version provided by their hosting company, operating system package manager or container image, and restart the relevant PHP services and workers so the patched runtime is loaded.
For sites that cannot be patched immediately, PHP’s security guidance describes configuration changes that can reduce exposure to certain attack paths. However, these measures are incomplete and should not be treated as a replacement for installing the official security updates. Administrators should also review server logs for suspicious requests, unexpected HTTP 500 errors, unusual PHP worker restarts and other signs of possible exploitation.
PHP users running older branches should check whether their operating system or hosting provider offers a security backport. PHP 8.1 and earlier no longer receive regular security updates directly from the PHP project, while PHP 8.2 is scheduled to reach end of life on December 31, 2026. Moving to a supported and patched PHP release is therefore an important part of maintaining website security.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
With exploitation attempts already reported, administrators should treat these vulnerabilities as an urgent security issue. Applying the correct PHP security updates remains the most reliable way to protect vulnerable websites and servers from PHP2Shell attacks.
PHP Releases Emergency Patches for Two Critical Flaws That Could Let Hackers Take Over Servers
