PHP2Shell Vulnerability: Critical PHP Security Flaws Put Websites at Risk Worldwide

Two critical vulnerabilities in PHP have triggered an international cybersecurity response, raising concerns for website owners, hosting providers, businesses and government organizations. Identified as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities have been collectively nicknamed PHP2Shell.

The flaws affect PHP, one of the most widely used server-side programming languages on the internet. Since PHP powers WordPress and numerous other content management systems, e-commerce platforms and business applications, a vulnerability in its core runtime can have consequences far beyond a single website.

The PHP development team released emergency security updates on October 21, 2026. Organizations are now working to identify vulnerable systems, install patches and determine whether their infrastructure requires additional protective measures.

The incident has also prompted precautionary shutdowns of websites and systems. Government websites in several European countries reportedly went offline while operators assessed the risks and applied security measures.

But how many websites are actually down? Can WordPress websites be affected? Which PHP versions need updating? And what should website owners do to protect their servers?

Here is everything you need to know about the PHP2Shell vulnerability, its potential impact and the steps required to secure affected websites.

What Is the PHP2Shell Vulnerability?

PHP2Shell is the collective name used for two critical vulnerabilities affecting the PHP runtime. They are tracked under the following identifiers:

• CVE-2026-109618
• CVE-2026-109619

Both vulnerabilities have been reported with a CVSS v4.0 severity score of 9.2, placing them in the critical severity category.

PHP is responsible for executing server-side code, processing user requests, interacting with databases and generating dynamic web pages. When a vulnerability affects the PHP runtime itself, the potential impact can extend to any application running on an affected configuration.

Under certain conditions, the PHP2Shell vulnerabilities may allow attackers to execute malicious code on a vulnerable server without first authenticating themselves. The flaws can also expose sensitive information stored in process memory.

This is particularly concerning for websites that process customer information, handle payments, store authentication credentials or connect to business databases.

The vulnerabilities are not limited to a specific WordPress plugin or theme. They affect the underlying PHP execution environment, which means that updating application code alone may not resolve the problem.

Website administrators can review the latest announcements on the official PHP website.

Understanding the Two Critical PHP Vulnerabilities

Although the vulnerabilities are collectively called PHP2Shell, they involve different problems with PHP's internal memory management and request processing.

CVE-2026-109618: A vulnerability involving out-of-memory handling

Applications allocate memory while processing requests, storing temporary data and performing calculations. When available memory becomes insufficient, software must handle the situation safely.

The first PHP2Shell vulnerability involves the handling of out-of-memory conditions during request processing.

Under particular circumstances, PHP may interrupt an operation while some internal request data remains only partially initialized. If later cleanup operations treat that incomplete data as valid, memory corruption can occur.

Researchers have demonstrated that this behavior can potentially be developed into remote code execution under affected conditions.

Remote code execution is a serious security risk because it may allow an attacker to make a vulnerable server execute code without authorization. Depending on the server's configuration and permissions, this could lead to unauthorized access to application data, modification of website files or further attacks against connected systems.

The precise impact depends on the affected environment, PHP configuration and privileges available to the PHP process.

CVE-2026-109619: A memory-management vulnerability

The second vulnerability involves internal state and memory that has already been released.

When software no longer needs a block of memory, it should stop accessing that memory. A use-after-free vulnerability occurs when a program continues using memory after it has been freed.

PHP2Shell's second flaw involves internal request-related state that may remain accessible after the memory backing it has been released.

Under certain circumstances, a later request handled by the same worker may encounter this stale state before the appropriate initialization takes place.

This can contribute to memory corruption and potentially enable remote code execution.

Memory-management vulnerabilities are particularly difficult to diagnose because their behavior may depend on request timing, process reuse and the arrangement of data in memory.

Why are these vulnerabilities so serious?

The two flaws are concerning because researchers have described exploitation techniques involving memory corruption and information disclosure.

Sensitive information held in process memory can include authentication tokens, credentials, API keys and other confidential data, depending on the application.

However, a demonstrated exploitation technique does not mean every vulnerable website has been compromised. Website owners must distinguish between a vulnerability being present, an attack being attempted and an attacker successfully gaining access.

Detailed technical explanations are available in the Wiz Research PHP2Shell investigation.

How Many Websites Are Down Because of PHP2Shell?

One of the most important questions surrounding this incident is the number of websites affected worldwide.

As of October 23, 2026, a reliable, independently verified worldwide count of websites taken offline specifically because of PHP2Shell has not been established in the reporting reviewed for this article.

However, the absence of a definitive outage count does not mean the incident is insignificant.

A cybersecurity incident can involve several different categories of systems:

• Websites that are running vulnerable PHP versions.
• Servers that have not yet received the relevant security updates.
• Websites deliberately taken offline as a precaution.
• Systems that have experienced attempted exploitation.
• Systems confirmed to have been compromised.

These categories should not be combined into a single number.

A server may host dozens or hundreds of websites. Likewise, a company may temporarily disable one application while keeping its other services operational. A server being vulnerable does not automatically mean every website hosted on it is offline.

Approximately 1.5 million PHP hosts were potentially exposed

An October 21 report by Reuters cited an assessment from internet intelligence company Censys that identified approximately 1.5 million out of 2.6 million hosts reporting a PHP version for which a fix was not available at the time of measurement.

This figure highlights the scale of potential exposure during the initial response.

However, 1.5 million potentially exposed hosts does not mean 1.5 million websites were down or hacked.

The measurement was taken during the initial emergency response. It should not be presented as the current number of vulnerable hosts without a fresh assessment.

The number of affected systems can change as hosting providers install patches, administrators upgrade their environments and security researchers conduct additional measurements.

The distinction is essential for understanding the real-world impact of PHP2Shell.

Government Websites Reportedly Taken Offline

Government websites have been among the services affected by the precautionary response.

According to Reuters reporting on the PHP2Shell incident, government websites in the Netherlands, France, Denmark and Finland went offline as organizations responded to the vulnerabilities.

The Dutch cybersecurity agency also reportedly took its own website offline as a precaution.

The Wikimedia Foundation and the Internet Archive also reported temporary shutdowns involving systems that needed to be secured.

These actions demonstrate that the response extended beyond ordinary business websites to major organizations and public-facing services.

Why would a government take its website offline?

Taking a website offline can be a preventive security measure rather than evidence that hackers have already gained access.

When an organization identifies a critical vulnerability, its security team may decide that temporarily disabling a service is safer than allowing it to remain publicly accessible while a patch is prepared or deployed.

This decision can be especially important when:

• The affected system is directly accessible from the internet.
• A patch cannot be applied immediately.
• The organization cannot confidently rule out exploitation.
• The application handles sensitive information.
• Temporary protective measures are insufficient.

Once the necessary fixes are installed and verified, the organization can restore the service according to its security and operational procedures.

A website returning online does not necessarily mean every related internal system has been remediated. Administrators must verify their complete environment.

Are Indian government websites affected?

The international response naturally raises questions about Indian government websites and public services.

However, the information reviewed for this article does not establish a verified count of Indian government websites taken offline specifically because of PHP2Shell. It also does not establish that a particular Indian government portal was compromised by these vulnerabilities.

Indian organizations should nevertheless take the issue seriously. PHP is used around the world, and exposure depends on the software version, hosting environment and patch status rather than geographical location.

Government departments, public-sector organizations, hosting providers and private businesses should check their PHP deployments and follow guidance from their security teams.

For Indian cybersecurity advisories, administrators can visit the Indian Computer Emergency Response Team (CERT-In).

Is WordPress Affected by PHP2Shell?

Yes. WordPress websites running vulnerable PHP environments may be exposed to PHP2Shell.

WordPress uses PHP to execute its application code, process requests and communicate with databases. If the underlying PHP runtime is vulnerable, the website may be at risk even when WordPress core, themes and plugins are up to date.

This is an important distinction for website owners.

Updating WordPress does not automatically update PHP. Likewise, installing a security plugin does not replace the need to patch the PHP runtime.

Other applications built on PHP, including Drupal, Joomla, Magento and custom PHP applications, may also be affected when they run in vulnerable environments.

Can a WordPress security plugin fix PHP2Shell?

A security plugin can help monitor a website, detect suspicious activity and provide additional defensive measures. A web application firewall can also block some malicious requests.

However, these measures should not be considered complete replacements for the PHP security update.

Website administrators should first establish whether their active PHP runtime is affected, then apply the appropriate fix through their hosting provider or server management process.

For WordPress websites, it is also important to check whether different domains, staging sites, scheduled tasks or command-line applications use separate PHP environments.

Which PHP Versions Need to Be Updated?

The PHP development team published security fixes on October 21, 2026.

The fixed releases reported for the affected PHP branches include:

Administrators should check the official PHP security announcements before making changes.

Older PHP branches, including PHP 8.1 and earlier, also require attention. These branches may be unsupported by the upstream PHP project, although some operating-system vendors and hosting providers offer security patches for specific packages.

Do not assume a server is safe based solely on the version number displayed in a control panel. Some vendors backport security fixes without adopting the same version numbering used by upstream PHP releases.

The correct approach is to verify the actual package, its patch status and the security advisory issued by the relevant vendor.

How to Check Whether Your Website Is Vulnerable

Website owners can start with a few practical checks.

Method 1: Check the hosting control panel

If your website uses managed hosting, sign in to your hosting dashboard and locate the PHP version manager.

Check the version assigned to the affected domain. Then review the provider's security guidance to confirm whether the relevant PHP2Shell patches have been applied.

If the fixed version is unavailable, contact hosting support and ask when the patched runtime will be deployed.

Method 2: Check WordPress Site Health

For WordPress websites:

1. Sign in to the WordPress administration dashboard.
2. Open Tools → Site Health.
3. Select the Information tab.
4. Expand the Server section.
5. Check the PHP version reported by WordPress.

This is a useful first step, but it does not independently prove that the runtime is patched. Your hosting provider may use vendor-patched packages or multiple PHP environments.

Method 3: Contact your hosting provider

If you are unsure about your PHP installation, ask your hosting provider to confirm:

• Whether the active PHP runtime is affected by CVE-2026-109618 or CVE-2026-109619.
• Whether the relevant security fixes have been installed.
• Whether PHP-FPM workers or other long-running processes are using the patched runtime.
• Whether older PHP branches receive backported security fixes.
• Whether any suspicious activity has been detected in the affected environment.

Avoid leaving publicly accessible diagnostic files on your website because they may expose sensitive server information.

How to Fix the PHP2Shell Vulnerability

Updating PHP to an appropriate patched release is the primary remediation.

Step 1: Identify all PHP applications

Create an inventory of your websites and applications that rely on PHP.

Include WordPress websites, e-commerce stores, business portals, staging environments, internal tools and applications that may use separate PHP versions.

Do not assume that updating one domain secures every application hosted on the same account or server.

Step 2: Install the appropriate security update

Upgrade to the relevant fixed release or install the security update provided by your operating-system vendor or hosting provider.

For example, an affected installation on the PHP 8.4 branch should be moved to the appropriate fixed release, 8.4.27, or a later secure release recommended by its vendor.

Check application compatibility, but do not allow routine testing to create unnecessary delays in addressing a critical vulnerability.

Step 3: Restart or reload the relevant runtime

Follow your hosting provider's instructions to ensure that the active PHP runtime uses the patched code.

Depending on the environment, this may require restarting PHP-FPM, reloading a web server or allowing a managed hosting platform to complete the upgrade.

The procedure varies by infrastructure, so production administrators should follow their provider's documented process.

Step 4: Verify the update

Confirm the installed package or runtime version and check the vendor's security advisory.

Test critical website functionality, including login, forms, database operations, scheduled jobs and e-commerce checkout.

Step 5: Investigate potential compromise

Patching closes the known vulnerability in the updated runtime, but it does not automatically remove malicious code that may have been installed before the fix.

Review relevant logs and security alerts. Look for unfamiliar administrator accounts, unexpected file modifications, suspicious processes, unauthorized scheduled tasks and unusual authentication activity.

If compromise is suspected, preserve relevant evidence and involve a qualified incident-response team.

Step 6: Apply temporary protections if required

If an immediate update is not possible, consult official guidance and your provider's mitigation instructions.

A web application firewall may reduce exposure, but it should not be treated as a complete substitute for patching.

If a critical internet-facing system cannot be updated or adequately protected, temporarily taking it offline may be the safer option, subject to the organization's incident-response and business-continuity procedures.

How Artificial Intelligence Played a Role in Discovering PHP2Shell

One notable aspect of the PHP2Shell incident is the role of AI-assisted security research.

According to published research, the vulnerabilities had existed in PHP's codebase for years. Identifying their practical exploitation required a detailed understanding of memory handling, request processing and internal program behavior.

Researchers associated with Calif and Wiz reported findings involving the vulnerabilities. Wiz described using AI-assisted research techniques, while OpenAI reported supporting coordinated vulnerability research through its Patch the Planet initiative.

The PHP maintainers then addressed the vulnerabilities and released security updates, with researchers and security providers contributing technical analysis and defensive measures.

The incident highlights how artificial intelligence is changing cybersecurity.

AI-assisted tools can help researchers analyze complex software, investigate unusual program behavior and discover weaknesses that may otherwise remain undetected for years.

At the same time, the publication of technical details can help malicious actors understand vulnerabilities and develop exploitation techniques. This increases the importance of responsible disclosure, timely patching and effective coordination between software developers and security teams.

The development does not mean every vulnerability can be discovered or exploited instantly using AI. It does demonstrate why organizations must respond quickly when a critical flaw is confirmed.

Read more about AI-assisted vulnerability research in OpenAI's coordinated disclosure announcement.

Are Hackers Already Exploiting PHP2Shell?

Security reporting indicates that suspicious exploitation attempts were observed around the disclosure period.

Reuters reported that Amazon's security team detected an attempted exploit against a honeypot on October 17, before the public disclosure. Cloudflare also reported observing attack traffic and attempts to modify payloads to evade protective measures.

A honeypot is a monitored system designed to attract or detect suspicious activity. Observing an exploit attempt against such a system is an important warning sign, but it does not prove that the attack succeeded against a production website.

Similarly, detecting malicious traffic does not mean every vulnerable server has been compromised.

Website administrators should nevertheless treat the incident as urgent. Once vulnerability details become public, attackers can use them to identify exposed systems and test whether they remain vulnerable.

The appropriate response is to patch the affected runtime, review security logs and investigate potential compromise rather than waiting for evidence of an attack against an individual website.

What Should Website Owners Do Immediately?

The following checklist can help administrators organize their response.

• Identify all websites and applications running PHP.
• Check the PHP version and patch status for each environment.
• Prioritize public-facing servers and critical business applications.
• Install the appropriate PHP2Shell security updates.
• Verify that the patched runtime is active.
• Check vendor advisories for applications and appliances that bundle PHP.
• Review security logs for suspicious activity.
• Investigate potential compromise instead of assuming patching removes existing threats.
• Maintain backups and confirm that recovery procedures work.
• Monitor official PHP and cybersecurity announcements for further guidance.

Additional precautions for WordPress administrators

WordPress administrators should also review administrator accounts, plugin and theme files, scheduled tasks and unusual login activity.

Keep WordPress core, plugins and themes updated, but remember that these measures address different risks from a PHP runtime vulnerability.

If you manage multiple client websites, maintain an inventory of domains, hosting accounts and PHP versions. Confirm remediation with each provider rather than assuming that every site on the same hosting platform has been updated.

For WooCommerce stores, test checkout, payment integrations and order processing after upgrading PHP.

Frequently Asked Questions About PHP2Shell

What is PHP2Shell?

PHP2Shell is the collective name for two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under vulnerable conditions, the flaws can enable remote code execution and sensitive memory disclosure.

How severe are the PHP2Shell vulnerabilities?

Both vulnerabilities have been reported with a CVSS v4.0 score of 9.2, placing them in the critical severity range.

How many websites have been taken offline?

A verified global total of websites taken offline specifically because of PHP2Shell was not available in the information reviewed for this article. Government websites in several European countries and systems operated by major organizations were reportedly taken offline as a precaution.

Were 1.5 million websites hacked?

No. The approximately 1.5 million figure reported during the initial response refers to potentially exposed PHP hosts in a particular measurement. It is not the number of websites confirmed to have been hacked or taken offline.

Is WordPress vulnerable to PHP2Shell?

WordPress websites running affected PHP environments may be vulnerable. Updating WordPress core or installing a security plugin alone does not fix a vulnerability in the PHP runtime.

Which PHP versions contain the fixes?

The fixed releases published on October 21, 2026, include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should verify their exact environment against the official PHP security announcements.

Can a firewall protect a vulnerable PHP website?

A web application firewall can provide an additional layer of protection, but it is not a complete replacement for the PHP security update.

Does an affected website automatically mean it has been hacked?

No. Vulnerability exposure, attempted exploitation, successful compromise and precautionary shutdowns are different events. Administrators should patch the vulnerability and investigate any evidence of unauthorized access.

Should a website be taken offline if it cannot be patched?

That decision depends on the system's exposure, available mitigations and operational importance. If a critical public-facing system cannot be updated or adequately protected, taking it offline temporarily may be appropriate.

Where can website owners find the latest PHP2Shell updates?

Administrators should regularly check the official PHP security announcements, the UK National Cyber Security Centre and the Canadian Centre for Cyber Security.

Conclusion: Why PHP2Shell Requires Immediate Attention

PHP2Shell demonstrates how vulnerabilities in widely used web infrastructure can create security challenges for organizations across the world.

The two PHP flaws have prompted emergency security releases, cybersecurity warnings and precautionary shutdowns involving government and major online services. Researchers have demonstrated serious exploitation scenarios, and security providers have reported suspicious attack activity.

However, the number of vulnerable hosts must not be confused with the number of websites taken offline or successfully compromised. A complete worldwide outage count has not been established in the reporting reviewed for this article.

For website owners, the priority is clear: identify affected PHP environments, install the appropriate security updates, verify that the patched runtime is active and investigate suspicious activity where necessary.

WordPress administrators should pay particular attention to the PHP version assigned to their websites. Keeping WordPress core, plugins and themes updated is important, but it does not eliminate the need to patch PHP itself.

As the international response continues, administrators should monitor official security announcements and avoid delaying remediation.

The most effective response is to act on verified security guidance, secure vulnerable systems and investigate potential compromise before a preventable vulnerability becomes a serious incident.