Plain English

What is PHP2Shell?

PHP2Shell is a pair of critical security bugs in PHP — the software behind most websites. Attackers can use them to take over a web server without a password. A fix exists; the risk is servers that do not get it.

Last reviewed 2026-10-22

The 30-second version

What

Two bugs (CVE-2026-109618, CVE-2026-109619) in the PHP engine, found by researchers at Wiz, OpenAI and Calif.

Why it’s serious

No login needed, works over the internet, and PHP runs a huge share of the web — any site on an unpatched PHP is exposed.

What fixes it

Updating PHP on the server and restarting it. Done by your host, IT team or developer — not by a WordPress or plugin update.

An analogy

Think of your website as a shop and PHP as the building it sits in. Locking the shop’s front door (passwords, plugins, updates to your site) does not help if the building itself has a broken back entrance. PHP2Shell is that broken entrance — the building owner (your host or server admin) has to fix it.

What should I do?

Pick the line that fits you.

I own a website (WordPress, shop, club site…)

Find out which PHP version your site runs and ask whoever hosts it to confirm it is patched. Updating WordPress or plugins does not fix it.

Check your site →

I manage a team or company

Ask IT or your agency: “Have all our PHP servers been updated for CVE-2026-109618 and CVE-2026-109619 and restarted?” Ask vendors the same about systems they run for you.

What IT should do →

I use online services (HR, payroll, shops)

Nothing, usually. Providers patch their own servers. Expect short maintenance windows. Be wary of phishing emails that use this news as a hook.

Who went offline →

I’m a journalist or just curious

The bug is in PHP itself, the fix shipped 21 October 2026, and the main risk is servers that are never updated.

How it unfolded →

Message for your web host or developer

email to your host
Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — patch status

Hi,

Please confirm that the PHP runtime serving my site(s) <domain> has been
updated to a release that fixes CVE-2026-109618 and CVE-2026-109619
(PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or a vendor build with the backport),
and that PHP-FPM / LSAPI workers were restarted afterwards.

If my account is on PHP 8.1 or older, please tell me which patched version
I can move to.

Thanks

Where the name comes from

“Shell” is hacker slang for control of a computer. The researchers called their combined exploit script php2shell — from PHP to a shell — and the name stuck for the whole research. It is sometimes misspelled php4shell, pho2shell or php2shel, and it is not related to “phpshell” webshell scripts.

Comparing it with Log4Shell?

Many people remember the 2021 Log4j crisis. Here’s how PHP2Shell compares →

Questions

What is PHP2Shell in simple terms?+

A pair of serious bugs in PHP, the programming language that runs most websites, including most WordPress sites. A stranger on the internet can use them to take over a web server or read secrets from its memory, without logging in.

What is PHP?+

PHP is the language that runs on the web server and builds the pages of roughly 70% of websites with a known server-side language — WordPress, Drupal, Joomla, Wikipedia’s MediaWiki, many online shops and in-house business tools.

What does RCE (remote code execution) mean?+

It means an attacker can make your server run instructions of their choosing, from anywhere on the internet. In practice that lets them steal data, install malware, change your website or use it to attack others.

Is PHP2Shell the same as a “PHP shell” or webshell?+

No. A webshell (often called phpshell) is a malicious script an attacker uploads after breaking in. PHP2Shell is the name of the vulnerability — named after the researchers’ exploit script, php2shell — that could let them get that far.

I just use a SaaS tool. Do I need to do anything?+

Usually not. Fixing it is the provider’s job. Watch their status page — some, such as BambooHR, briefly went offline to patch — and change your password only if they ask you to.

Related