php2shell: Half the internet is at risk – only patching PHP will help
Hackers can execute malicious code on web servers without a password due to two critical PHP vulnerabilities. Around 70 percent of all websites are likely affected. Exploit code is already available. Only a PHP update will help.
Two critical security vulnerabilities in the PHP programming language are currently endangering millions of web servers. Attackers can use them to execute malicious code without a password – an anonymous post on the Hacker News platform had already revealed the vulnerabilities and initial exploit code in advance on October 20. The patches were released on October 21 at 4:00 PM CEST. Due to the explosive situation, entities such as the Netherlands and the GrapheneOS developers have temporarily taken their systems offline as a precaution. A sign of how serious the situation is.
What exactly happened
The PHP security team has released patches for two critical vulnerabilities that allow attackers to execute arbitrary code on a server. They carry the CVE numbers CVE-2026-109618 and CVE-2026-109619 and are also referred to as "php2shell" in reference to the infamous Log4Shell vulnerability of 2021. Both were rated with a CVSS score of 9.2 out of 10 – the highest category for critical vulnerabilities.
The first vulnerability (CVE-2026-109618) concerns memory management. When a PHP script hits its memory limit, execution aborts and the memory is cleaned up. If an attacker disrupts this cleanup process with specially crafted requests, they can manipulate the memory so that PHP executes their own malicious code. The second vulnerability (CVE-2026-109619) exploits a stale state in error handling: data from an old request remains in memory and is incorrectly treated as current in the next request. This also allows for the injection of malicious code.
Why so many are affected
PHP is the foundation upon which a large part of the web is built. Around 70 percent of all websites whose server-side programming language is known use PHP. Content management systems like WordPress, Drupal, Joomla, and Magento are based on it. However, updating these systems is not enough to be safe. The error lies deeper, in the PHP runtime environment itself.
The vulnerabilities do not only affect current PHP versions. They run through the code back to PHP 5.4, which was released in 2012. Many web servers still run on older, no longer supported PHP versions without regular security updates.
What you need to do now
The only complete solution is to update to one of the newly released PHP versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. These patches must be installed manually on the server – automatic updates do not apply here. For older, no longer supported versions (PHP 7.4, 8.0, 8.1), the PHP team has provided minimal source backports.
If you are not responsible for the server yourself, you should ask your hoster whether the security updates have already been installed. For systems that cannot be updated immediately, authorities advise taking them offline. Cloudflare has already rolled out firewall rules that block known attack patterns. Such protective measures can reduce the risk but do not replace a security update.
How bad is it really?
The warnings are coming from the highest levels. For example, the German Federal Office for Information Security (BSI) has issued an official warning. CERT-EU, the British NCSC, and the Australian cyber authority have also issued emergency alerts.
It is currently unclear how many servers have already been successfully attacked. As of October 21, 2026, 6:00 PM CEST, there are no reliable figures on confirmed compromises. Cloudflare is already reporting attack attempts and has tightened its protection rules. Other security researchers, however, have not yet detected any exploitation in their monitored networks. The risk is real and increases with every hour that servers remain unpatched.
I find my muse in everything. When I don’t, I draw inspiration from daydreaming. After all, if you dream, you don’t sleep through life.
From the latest iPhone to the return of 80s fashion. The editorial team will help you make sense of it all.
Show all
