Two critical flaws in PHP, the software that runs a large share of the world websites, can let an attacker take over a website server without any password. The flaws, grouped under the name PHP2Shell by security firm Wiz, were patched in an emergency release on October 21, and reports of exploitation attempts began the same day. Website owners who have not updated are being urged to patch immediately.

What Is PHP2Shell

PHP2Shell is not a single bug. It is the name Wiz Research gave to two related memory safety flaws it found in core PHP with the help of Calif and frontier AI models, and reported privately to the PHP project in August 2026. OpenAI later said researchers at Calif used its tools through its Patch the Planet programme, and that it helped test the fixes and coordinate the response with infrastructure providers. Both flaws carry a severity score of 9.2 out of 10.

The first flaw, tracked as CVE-2026-109618, sits in the way PHP handles session upload progress. The second, CVE-2026-109619, involves error handling and the OPcache system that speeds up PHP sites. In both cases, the problem starts when PHP runs out of memory or hits a fatal error in the middle of a request and leaves stale internal data behind, which a later request can then misuse.

How the Attack Works, in Simple Words

Remote code execution, often shortened to RCE, means an attacker can make a distant computer run commands of their choice, as if they were sitting at its keyboard. A use-after-free flaw means a program keeps using a piece of memory after it has been cleared and given back, so the contents can no longer be trusted. PHP2Shell chains these weaknesses together.

In practice, an attacker sends a carefully built request that pushes the server into an error, then sends a second request that tricks PHP into treating leftover data as valid. Wiz demonstrated working pre-auth attacks, meaning no login was needed, against fresh WordPress, Drupal and Joomla installations. The same session flaw can also leak server memory, which may contain passwords, login tokens, API keys and certificates belonging to the site or to people using it at that moment.

Why Even a Simple Website Is at Risk

The flaw is in PHP itself, not in any one app built on it. Wiz has pointed out that even a basic Hello World page served by an affected PHP version sits on the vulnerable code, because the weakness is in how PHP handles requests, errors and memory, not in what the website does.

According to Wiz, every PHP version of the last decade, going back to PHP 5.4, is affected by at least one of the two issues. Exposure scans underline the scale: Modat counted more than 4.38 million PHP services on about 1.88 million hosts, and a large share were running old, unsupported branches, with PHP 7.4 the single biggest group. Unsupported versions will not receive the official fix.

Patch Released on October 21, Exploitation Reported the Same Day

The PHP project released fixed versions out of its normal schedule on October 21, 2026: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Technical details of the flaws had leaked before the release, which shortened the time website owners had to prepare.

Exploitation was reported before many sites could update. Patchstack said it received reports of active exploitation incidents from hosting partners at 07:34 UTC on October 21, and Cloudflare chief technology officer Dane Knecht reported early attacks, after which Cloudflare deployed web application firewall protections for its customers. The full extent of successful compromise is not established yet, and these reports should be read as reported exploitation activity, not as a confirmed count of breached sites. Threat intelligence firm watchTowr, which was also observing attempts in the wild, said at the time that nobody had been successful to date, while adding that it did not expect that position to last long.

What Website Owners Should Do Now

Patching is the only complete fix. Owners should check the PHP version on their server or ask their hosting provider, and move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. Sites still on PHP 8.1 or older need to upgrade to a supported branch first, because no patch is coming for end of life versions.

Defenders have also been told to watch for warning signs: unusual multipart requests followed by memory limit errors or repeated 500 errors, malformed PHPSESSID cookies, and PHP worker processes restarting again and again. If a site handled sensitive data and was exposed unpatched, owners should also check for signs that an attacker may already have got in, rather than assuming the patch alone closes the matter.

What Happens Next

Public proof of concept code is already circulating, although researchers note that some early proofs rest on a theory that has since been invalidated, so not every published exploit works as claimed. Working attacks, however, have been demonstrated, and scanning for vulnerable servers is expected to continue in the coming days. The next updates are expected from hosting companies, the PHP project and security firms tracking exploitation, and this article will be updated as confirmed figures emerge.