About
About this guide
A vendor-neutral, action-first summary of PHP2Shell. It collects what the PHP advisories, the researchers and the security vendors published, and turns it into steps you can run.
Last reviewed 2026-10-22
Principles
- Official sources win. Where reports disagree, this guide follows the PHP security advisories.
- No product pitches. No vendor is recommended over another.
- Uncertainty is labelled. “Confirmed”, “susceptible” and “likely” mean different things here and are used deliberately.
- No exploit code. This site covers defence only.
- Translations follow English. If a translation and the English page disagree, the English page is the reference. Commands and configuration stay in English.
Official PHP sources
Original research
- Wiz ResearchPHP2Shell technical write-up
- CalifPHP2Shell
- OpenAICoordinated disclosure of critical vulnerabilities
- Wiz (original page)php2shell.com
Security vendor analyses
- CloudflareWAF protection for PHP vulnerabilities
- AkamaiCritical RCE vulnerabilities in PHP core
- ImpervaPHP2Shell vulnerability updates
- CorelightPHP2Shell detection
- CrowdStrikeProtecting customers from PHP RCE zero-days
- Unit 42CVE-2026-109618 / CVE-2026-109619
- Cisco TalosTwo critical RCEs in PHP core
- watchTowrPHP RCE FAQ: CVE-2026-109618
- SansecPHP2Shell: critical PHP RCE