PHP2Shell Explained: The PHP Flaw Putting 70% of Websites at Risk

On October 21, 2026, the PHP project released emergency security updates for two critical flaws that together became known as PHP2Shell. Because PHP runs an estimated 70% of websites, the disclosure set off one of the broadest patching scrambles the web has seen, with government agencies urging updates and some public sites taken offline as a precaution. This guide explains what the bugs are, which versions are fixed, what is still disputed and what to check on your own servers.

What happened

The PHP Foundation disclosed two critical vulnerabilities and shipped fixes on October 21, 2026, according to Fortune. Datadog dates the first public notice to October 20. A planned slower rollout was cut short when proof-of-concept details circulated online, which forced emergency builds. The FBI, the NSA, the UK's NCSC and CISA all told organisations to update, and the NCSC and FBI added that anything that cannot be patched should come offline until it can be.

The agencies' alarm came from what the bugs allow. An attacker does not need a password or an account. A single crafted web request can be enough to run commands on the machine that hosts a site, which is a foothold into whatever network that server sits on.

What the two bugs are

Both flaws sit in PHP's core, not in WordPress or any single application, which is why so many different sites are affected at once. Datadog's analysis describes them this way:

• CVE-2026-109618 is a memory-handling error. If a request forces PHP to run out of memory while it is still setting up, a half-built internal table can be left behind, and PHP's cleanup code then treats it as valid. A crafted form field name sized to cross the memory limit triggers it.
• CVE-2026-109619 is a use-after-free. State that belongs to one request can survive after its memory is released, and a later request handled by the same worker can pick it up. The confirmed routes involve upload processing, and fatal-error backtraces on PHP 8.5.

Any PHP runtime that serves HTTP is in scope, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Help Net Security reports that mod_php setups face the greatest risk. Datadog notes the PHP session upload-progress feature is on by default and runs even if an application never starts a session.

How big is the 70% claim

The headline number is an estimate, not a measurement of this bug. ABC News cites W3Techs for PHP powering roughly 70% of websites, and WordPress, which runs on PHP, on more than 40%. Fortune reports that Palo Alto Networks' first analysis found 22.6 million potentially vulnerable instances. That is a large number, but it is smaller than 70% of the web, because exposure depends on the PHP version and configuration. Sources also disagree on how far back the flaws reach. The official advisories list the supported branches, while security firm Sansec and a leaked exploit tool claim PHP 5.4 and later, so treat any very old install as exposed until proven otherwise.

Who found it, and how AI fits in

The AI angle explains why this is trending beyond security circles. Fortune reports that California red-teaming firm Calif found the first issue on August 1 using OpenAI's GPT-5.6 Sol, working under OpenAI's Patch the Planet initiative, and that Wiz, which Google owns, independently identified it on August 19 using several AI models. ABC News says the PHP team started on a fix on August 11. Fortune also notes a limited version of the bug was spotted in 2024 and not judged significant at the time.

The same speed cuts the other way. Fortune's headline frames the aftermath as a race to patch before AI-assisted attackers catch up. Amazon Threat Intelligence says it detected an exploitation attempt on a decoy system on October 17, and how the attacker got the details before disclosure is not known. Cloudflare told Fortune that tens of thousands of attempts arrived within 45 minutes of the news and millions by that evening. Amazon says the flaw is being broadly exploited, while CISA said in its notice that it had not seen exploitation. These accounts reflect different moments, so check the latest guidance before relying on either.

Fixed versions and what to do now

The upgrade targets are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 7.4, 8.0 and 8.1 the project published source backports only, so most people on those branches should wait for their Linux distribution or an LTS vendor such as Ubuntu to ship a patched package. Vendors may backport the fix without changing the version number, so check the package changelog rather than trusting php -v alone. A sensible order of work:

1. List every PHP site, app and API you run, including forgotten staging servers and bundled interpreters.
2. Find the live PHP version on each and upgrade to a fixed release or vendor patch.
3. Check logs back to October 17 for the signs Datadog lists: PHP "memory exhausted" fatal errors reported at "Unknown on line 0", Apache worker segmentation faults, and a web server process starting a shell.
4. If you cannot patch yet, put the site behind a web application firewall, restrict public access or take it offline.

Datadog lists configuration stopgaps for those who need time: memory_limit=-1 for the first bug, and session.upload_progress.enabled=0 plus, on PHP 8.5, fatal_error_backtraces=0 for the second, with all workers restarted. Both the PHP team and Datadog stress that these reduce exposure only. Cloudflare has also rolled out WAF rules for known attack patterns to all plans, including free ones, which helps but does not replace the update.

What it means in India

This story is global, but one fact is specific to India. India's CERT-In issued an advisory warning of a high risk of remote code execution and full system compromise, according to Inc42. Inc42 says exposure is likely high across government portals, schools and universities, small businesses and ecommerce, and that many organisations rely on shared hosting and outside developers who control the PHP version. Inc42 also reports DownDetector complaints about Airtel, Jio, IRCTC, State Bank of India and others in the hours after disclosure, but notes that the cause of those outages is not confirmed, so they should not be read as PHP2Shell fallout.

Network vendors and the road ahead

Help Net Security reports that Palo Alto Networks said all PAN-OS and Panorama versions are affected with no fixed release yet as of October 22, while Fortinet and Cisco were investigating and had not confirmed a vulnerable product. If you run network appliances, check vendor advisories as well as your own web servers. Datadog also warns that the patch defers memory errors and ends a worker on a hard limit, but leaves the underlying hash-table pattern, so it expects more bugs of this type.

Frequently asked questions

Related articles