PHP2Shell: the flaws in PHP that put most websites at risk

On October 21, 2026, the PHP project fixed two flaws in the language itself. With a single crafted request, an attacker can take over a web server before any website code runs and without a password. PHP runs on 69.3 % of all websites whose server language is known, from small blogs to large online shops.

Whether a website is affected depends on the PHP version of its server, not on the version of WordPress, Joomla, or any other application. Your host’s control panel shows it, and so does the system information of most applications (see the table of applications below); on the server itself, the command php -v prints it.

Fixed PHP versions

PHP applications: what they need and where they show your PHP version

61 widely used applications that run on PHP. Each one is affected only through the PHP version of the server it runs on. 7 of them carry a warning sign: a version the vendor still maintains runs only on PHP without a fix, or the vendor has not yet shipped the fixed PHP.

Find your application

From the applications' own documentation and source code, checked on October 23, 2026. Only applications whose code base is confirmed to be PHP are listed. If a provider runs the application for you, the provider updates PHP.

How the attack works

When a request needs more memory than PHP allows, PHP stops it at once and jumps out of the code that was running. The finders discovered that this can happen at the worst possible moment: halfway through building a list of uploaded files, or while data from the request is still in use. What is left behind is half-built data that PHP later treats as complete.

An attacker can trigger this from outside with an upload request built to run out of memory at exactly that point, without logging in and before the website’s own code even starts. The second flaw goes further: leftover data from one request survives into the next request handled by the same worker process, which then reuses memory that was already freed. Together, the two flaws let an attacker read the server’s memory and run commands with the rights of the web server.

According to the PHP project, every PHP installation that serves web pages is at risk: as an Apache module, through PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed. The risk is highest with the Apache module, where the attack works before any application code runs; with PHP-FPM, the finders needed a route through the application.

Which applications are affected

Every application that runs on an affected PHP version is exposed, because the flaw sits underneath it. The finders took over servers running these eleven applications in their tests:

The list of applications under the check above shows more PHP applications, the PHP versions they need, and where they show the PHP version of your server.

Three scores for the same flaw

The PHP project rates both flaws 9.2 on version 4.0 of the CVSS scale. The US National Vulnerability Database gives 9.8 on version 3.1, the scale this series uses for every case. A score of 10.0, which spread online the day before the release, was wrong, the PHP Foundation says.

A release under pressure

The flaws were reported to PHP from August 2026, by Calif, Wiz Research, and OpenAI, independently of each other. The PHP Foundation says a core developer had seen first signs of the same root cause in 2024, when exploitation was not yet proven. The release was planned for October 22; the last day before it went differently.

On the evening of October 20, one of the finders also published a video of the attack by mistake; it was deleted but copied widely. The finders’ joint page php2shell.com shows the demonstrations on WordPress, Drupal, and Joomla.

On October 23, 2026, no attacks in the wild were known, and the US agency CISA rated exploitation as “none”. The finders have published how the attack works, so the update should not wait.

Found with AI, flooded by AI

PHP2Shell also shows how AI is changing the search for vulnerabilities. The PHP Foundation brought PHP into Patch the Planet, a program by OpenAI in which security firms help open-source projects find and fix flaws; as part of it, Calif began auditing PHP on July 30, 2026. Wiz says it found its first bug with its own tool, Wiz Atlas, and the AI models Gemini 4 Argon and GPT-5.6 Sol. Earlier in 2026, the PHP Foundation had already had PHP scanned with Anthropic’s model Claude Mythos, together with the Alpha-Omega project.

The other side: the PHP security team now receives far more reports than before. Since July 1, 2026, it has published 15 CVEs and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. AI helps the team sort the reports, the PHP Foundation says, but a person makes every decision and works on every patch.

If you cannot update today

The PHP project and the finders name settings that make an attack harder until the update is installed. They warn that these settings do not cover every variant of the attack.