PHP2Shell Explained: How AI Exposed a 14-Year-Old PHP Flaw and How to Protect Your Website

As the Founder and CEO of Acquaint Softtech, a PHP development company and Official Laravel Partner, I have worked with PHP for more than 13 years. On October 21, 2026, government, hospital, and business websites across Europe, the UK, and Australia went offline within hours of each other. The cause was a flaw inside PHP itself, and our team spent this week helping businesses understand their risk and fix it.

PHP2Shell is not a bad plugin or one company's mistake. It sits in the engine behind WordPress, Laravel, and Drupal. The good news: the fix is out, and it is simple to apply when you know what to check.

---

PHP2Shell explained: what happened and when

PHP2Shell is a set of memory bugs in the core PHP engine. Because the weakness is in PHP, not your code, even a well-built website is at risk.

Key fact	Details
Official names	CVE-2026-109618 and CVE-2026-109619
Severity	9.2 out of 10 (critical)
What attackers can do	Take over the server, or read passwords, tokens and API keys from memory, with no login
Which versions	Every PHP version from the last decade, back to PHP 5.4
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Status today	Attackers are actively using it

The PHP2Shell timeline

Date (2026)	What happened
August	Independent security researchers find the flaw with the help of AI models
August 24	The flaw is reported privately to the PHP security team
September 21	The PHP team confirms the reports and starts building a fix
October 20	Details leak early, attacks begin, CERT-EU issues a warning
October 21	PHP releases the fixed versions and the research goes public

How AI exposed the flaw and how the attack works

AI did not create this flaw. It made an old, hard-to-use flaw easy to use.

Why it stayed hidden for 14 years

The weak code sat in PHP for about 14 years for three reasons:

• It needed many bugs linked together. One bug alone could not break into a server.

• Every server behaves differently. The attack had to be adjusted for each PHP version and setup.

• It was at the limit of human effort. Doing this by hand would take a top team months.

Advanced AI models removed that barrier by testing and adjusting the attack at high speed. One researcher with AI did in a week what once took months, and attackers have the same tools.

How the attack works

In simple terms, the attacker makes PHP crash on purpose, and PHP leaves "dirty" memory behind for the next request to use. Think of a server as a hotel:

1. Each website visitor is a guest, and each room should be cleaned before the next guest.

2. The attacker sends a request that makes PHP run out of memory and stop suddenly.

3. Because of the bug, the room is not fully cleaned.

4. The next request walks into that room, and the attacker controls what is inside.

Researchers proved this can take over WordPress, Drupal and Joomla sites without a login. PHP fixed the root cause, so updated versions close every known variant. Because the attack runs below your application, your normal logs may show very little.

Why websites went offline around the world

Details leaked before the fix was ready, and attackers moved within minutes:

• Large internet providers saw tens of thousands of attack attempts within 45 minutes, and millions by that evening.

• CERT-EU advised organisations that could not update in time to consider taking sites offline. The US NSA gave similar advice.

Country	Examples of websites taken offline
Netherlands	Overheid.nl, Port of Rotterdam, KNVB football association, many hospitals
Finland	Government public web services, shut down by the state IT centre Valtori
United Kingdom	Several council websites and the Metropolitan Police
Australia	Government sites, including cyber.gov.au

Analysts estimate about 22.6 million PHP systems may be exposed. PHP runs around 70% of websites, but risk depends on each site's PHP version and update status.

Is your website at risk?

If your site runs on PHP and has not been updated since October 21, 2026, treat it as at risk. Check three things:

1. Does it run on PHP? WordPress, WooCommerce, Laravel, Statamic, Drupal, and Magento all do.

2. Is your PHP version below the fixed version? Check the table below.

3. Have you forgotten PHP systems? Old microsites, test servers, and unused admin panels are often missed. 

Your PHP version	At risk if lower than	What to do
PHP 8.5	8.5.12	Update to 8.5.12 or higher
PHP 8.4	8.4.27	Update to 8.4.27 or higher
PHP 8.3	8.3.36	Update to 8.3.36 or higher
PHP 8.2	8.2.35	Update to 8.2.35 or higher
PHP 8.1 or older	No official update	No longer supported. Basic emergency fixes exist for 7.4, 8.0, and 8.1, but the safe choice is PHP 8.2 or higher

What about Laravel websites?

Yes, Laravel sites are affected. Updating Laravel does not fix PHP2Shell; the server's PHP must be updated. Apps on PHP 8.1 or older need a planned move first, which our version upgrade services handle without breaking features.

How to fix PHP2Shell: a 6-step plan

Updating PHP is the only full fix. Follow these steps in order:

Step	What to do
List every system	Note every server, hosting account, and container running PHP, with its version
Update PHP	Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm it
Restart PHP	Restart PHP-FPM or your web server; old processes keep running the weak code
Check the live version	Confirm the PHP version your live website actually uses
Look for an attack	Check for memory errors, many "500" errors, oversized session cookies, and unknown files
Change keys and passwords	Replace API keys, database passwords and tokens that may have been read from memory

# Check your PHP version
php -v
 
# Restart PHP-FPM after the update (change 8.3 to your version)
sudo systemctl restart php8.3-fpm

Cannot update today? Do this for now

• Turn on the emergency firewall rules your hosting or CDN provider has released for PHP2Shell.

• Limit public access to the website, or take it offline until it is updated.

• Turning off session.upload_progress alone is not a fix; it blocks only one attack path.

How Acquaint Softtech protects your PHP website

Think of us as the fire safety team for your website: when the alarm rings, we already know every room and every exit. With our support and maintenance services, PHP stays updated month after month, so alerts like PHP2Shell are handled before they become problems.

When an alert lands, we:

1. Find everything: every server and old site, with its exact PHP version.

2. Update without downtime: in a planned order that keeps your site live.

3. Prove the fix: by checking the version your live site actually runs.

4. Look for intruders and change the locks: replacing any exposed keys or passwords.

Short on hands this week? You can hire Laravel developers who join your team within 48 hours.

Case study: securing a live FinTech payment platform

FLIQA Payments, a Pay by Bank FinTech company in Slovenia, needed stronger security on a live Laravel platform moving real money every day. A rebuild was too risky. It is the same challenge PHP2Shell creates: fix the risk on a live system without downtime.

FLIQA's problem	How we solved it	Result
Sensitive banking data at risk	Built encrypted storage for all banking data	Data protected even if a server is reached
Weak access control	Added stronger API login checks and role-based access	Only the right people reach the right data
No clear record of actions	Built a full activity record for every collection and payout	Every payment became traceable
Security could slow payments	Moved heavy security work to background processing	Security improved with no loss of speed
A live system that could not stop	Delivered every change in phases over 8 months	No disruption to live operations

FLIQA’s CEO, Nina Strajnar, said our team “added what was necessary, avoided what was not.” Read the full FLIQA case study.

For stronger walls around your servers, hire DevOps engineers to set up firewall rules, secure key storage, and automatic security updates. With 79+ verified Clutch reviews, 70+ in-house engineers, ISO 27001 certification, and 1,300+ projects delivered, we bring the same care to every PHP security job.

Frequently Asked Questions