If you've noticed developers and server admins scrambling to patch their systems over the past few days, here's why: a new security flaw called PHP2Shell lets attackers take over a PHP server without needing to log in or know any password at all. This isn't a minor issue —” it's one of the most serious bugs ever found in PHP, the language that powers roughly 7 out of 10 websites worldwide, including WordPress, Drupal, Joomla, and hosting panels like cPanel and Plesk.
What Is PHP2Shell?
PHP2Shell is the name given to two flaws at once: CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS score of 9.2 out of 10 —” critical severity, close to the maximum possible. According to The Hacker News, either flaw lets an attacker with no account at all run their own code on the victim's server simply by sending a specially crafted HTTP request.
How Did It Get This Bad?
In short, the bug lives in PHP's file-upload progress tracking feature (session.upload_progress). If a request gets cut off midway —” say, because the server runs out of memory —” PHP is supposed to clean up that session data. The problem is that cleanup can fail and leave "ghost" data behind in server memory. A later request hitting the same PHP worker can abuse that leftover data to hijack program execution —” a technique security researchers call a use-after-free. According to research from JFrog Security Research, the attack happens at the PHP level itself —” not in your application code or plugins —” so your site can be affected even if your code is clean and secure.
What Makes It Even More Unsettling: Found Using AI
Here's the part that's as fascinating as it is unnerving: according to Help Net Security, this bug had actually been sitting in PHP for years, but exploiting it required an exceptionally complex chain of steps —” complex enough that it was practically impossible to find by hand. Two separate security research teams discovered it independently, both using advanced AI models to audit PHP's source code. The flaw then leaked publicly ahead of the planned disclosure schedule, leaving a window with no patch available at all before the official fix shipped.
Affected PHP Versions
The impact is broad. Affected versions include:
PHP 5.4 through 8.1 —” all no longer officially supported, so no full patch exists
PHP 8.2.x before 8.2.35
PHP 8.3.x before 8.3.36
PHP 8.4.x before 8.4.27
PHP 8.5.x before 8.5.12
In other words: if your server is running any PHP version released before October 21, 2026, your site is very likely vulnerable.
Why This Isn't Just a Technical Problem —” It's a Business Problem
If you own or manage a PHP-based business website —” an online store, a booking system, a company profile, anything —” this isn't just an IT team concern. If your server gets exploited, the impact can hit operations directly: customer data can be stolen, your site can be turned into a malware delivery point or a gateway into other systems, and attackers could even use your server to attack others without you ever knowing.
The scale here isn't small either. Several major services were reportedly affected or went down in incidents tied to this flaw, ranging from community forums to a number of government websites in various countries. If organizations that large can get hit, small and medium business websites —” which usually get updated far less often —” are clearly even more exposed.
If your site runs on shared hosting —” one server used by many accounts at once, the most common setup for small businesses and SMEs in Indonesia —” the risk gets more specific: because this bug lives at the PHP level rather than in website code, one compromised PHP worker can potentially open a path to attack other accounts sharing the same server.
This Isn't a Theoretical Threat
What makes this urgent: this isn't "a flaw that might get exploited someday." According to watchTowr's global honeypot monitoring, real exploitation attempts were already detected in the wild starting October 21, 2026 —” the same day the official patches shipped. That means in the window between the leak and the patch release, attackers had already started probing unpatched servers.
What You Should Do Right Now
Here are concrete steps for anyone running a PHP-based website:
1. Check your PHP version. If you run your own VPS or server, check with php -v or your hosting panel. If you're not on 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or newer, update immediately.
2. On shared hosting? The PHP version is usually controlled by your hosting provider, not you directly. Check your hosting panel (cPanel/Plesk) for a PHP version option, or contact your host's support directly and ask whether the server has been patched for CVE-2026-109618 and CVE-2026-109619.
3. Can't update PHP right away? As a temporary measure, server admins can disable the session.upload_progress feature in the PHP configuration to close off one exploitation path, then restart the PHP process.
4. Using Cloudflare or another WAF? Some WAF providers have already released rules specifically to block PHP2Shell attack patterns —” make sure that rule is active on your account.
5. Don't wait. Since exploitation is already active in the wild, every day your server stays unpatched is a day you're a potential target for automated attacker scans.
A secure website isn't just about good design and fast load times —” the infrastructure behind it needs regular updates too. PHP2Shell is a stark reminder that something as small as a file upload feature can end in a full server takeover if left unpatched.
