October 23, 2026 - 7 min read

By PhishClean Research Team

PHP2Shell: what site owners and visitors should do

Two critical flaws in PHP itself let an attacker who is not logged in run code on a web server. Patches shipped on 21 October 2026, and attack traffic started before they did.

PHP runs most of the web's content management systems, including WordPress, Drupal and Joomla. Wiz, whose researchers found the bugs, puts PHP behind about 70% of websites. That is why a bug in PHP's core engine matters more than a bug in any one plugin: every site on a vulnerable PHP build is exposed, however well its own code is written.

What PHP2Shell is

PHP2Shell is the name for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. According to Wiz, they come from how PHP handles fatal errors, especially running out of memory: the error leaves corrupted state behind, and a later request reuses it. Wiz describes four variants:

• a use-after-free in the session upload-progress handling,
• a remote read of the PHP process's memory,
• a use-after-free in the backtrace of a fatal error,
• a type confusion in OPcache.

The result is code execution on the server without logging in. Wiz demonstrated it against WordPress, Drupal and Joomla. The memory-read variant matters on its own too: process memory can hold database passwords, API keys, session tokens and certificates. CISA's alert says the flaws affect all PHP installations serving web requests.

Is it being exploited?

Attempts, yes. Successful break-ins, not confirmed as of 22 October:

• watchTowr has seen exploitation attempts against both CVEs in its honeypot network, but no successful ones.
• Cloudflare's CEO reported thousands of exploitation attempts in the 10 hours before public disclosure.
• Amazon spotted a probe on 17 October, before the flaws were public, and does not yet know whether any attempt succeeded.
• Several public proof-of-concept exploits are available.
• CISA had not added either CVE to its Known Exploited Vulnerabilities catalog as of 22 October.

Public exploit code plus mass scanning usually means mass compromise follows within days for sites that have not updated. Treat the window as already open.

Which PHP versions are fixed

Wiz reports that versions back to PHP 5.4 are affected. The PHP project only ships fixes for 8.2 and newer.

How to check your PHP version

• WordPress: Tools → Site Health → Info → Server shows the PHP version.
• Shell access: run php -v. The command-line PHP can differ from the one serving your site, so also check what your web server or PHP-FPM pool uses.
• Hosting control panel: cPanel, Plesk and most managed hosts show the PHP version per site, usually under "PHP version" or "PHP manager".
• From outside: some servers announce it in a response header.

curl -sI https://your-site.example | grep -i x-powered-by

No X-Powered-By header does not mean you are safe; many servers hide it. Check from the inside.

What to do as a site owner

1. Update PHP to a fixed release, then restart PHP-FPM or your web server so the new build is actually the one running.
2. On shared or managed hosting, the host updates PHP, not you. Check their status page or ask support whether your server runs a fixed build. Some hosts, such as SiteGround, have said their customers are protected.
3. If you cannot update today, set session.upload_progress.enabled = 0 in php.ini. It blocks one attack path for CVE-2026-109619 only; the PHP maintainers say there is no complete mitigation.
4. Look for signs of attack. Wiz lists unusual multipart requests followed by memory-limit errors or bursts of HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained PHP worker restarts. Application logs may show little, because this happens below your application.
5. If the site was exposed and unpatched, rotate secrets that live in PHP's memory: database passwords, API keys, payment and email credentials. Then check for files you did not add, new admin users, and scripts injected into your pages.

What it means if you only visit websites

You cannot patch someone else's server, and you cannot tell from the address bar whether a site runs a vulnerable PHP. What you can do is recognise what hacked sites tend to show their visitors. No reports so far tie a particular payload to PHP2Shell. In past waves of mass-hacked sites, though, the same few tricks keep coming back:

• Fake CAPTCHAs that ask you to paste a command. "Press Windows + R, then Ctrl + V, then Enter." Microsoft tracked a campaign this month that shows these prompts on hacked sites. No real CAPTCHA ever asks for a keyboard shortcut. See a CAPTCHA told me to press Win+R.
• Fake browser update and virus alerts that push a download or a phone number. See how to remove fake virus popups.
• "Click Allow to continue" pages that turn notification permission into a stream of scam ads. See why sites tell you to click Allow.
• Redirects and fake login pages served from a domain you already trust, so the address bar looks normal.
• Card skimmers on shop checkouts, which copy card details as you type them and send them to the attacker.

The common thread: the domain is real, so checks that only ask "is this a known bad site?" pass it. What gives these pages away is what they ask you to do.

Where PhishClean fits

PhishClean reads the page as well as the address, so its checks still work when a hacked site serves the trap from its own real domain. PhishClean 1.8.0, rolling out to the browser stores now, adds warnings aimed at exactly these pages:

• Fake CAPTCHAs that copy a command and tell you to press Windows + R. This one is free for everyone.
• Fake browser updates that offer a file to "update Chrome".
• Card skimmers: a warning when the card number you type on a checkout is sent anywhere other than a payment company or the shop itself.
• Scam search ads that name a brand's sign-in page but lead somewhere else.

They sit alongside the existing fake virus, "click Allow" and fake login checks. Everything runs on your device, and no page content is sent anywhere.

It does not fix the server. If you own a PHP site, updating PHP is the only real fix.

Frequently asked questions

Does updating WordPress fix PHP2Shell?

No. The flaws are in PHP itself, below WordPress, plugins and themes. Only a fixed PHP version helps.

Is there a workaround if I cannot update PHP today?

Setting session.upload_progress.enabled to 0 blocks one attack path for CVE-2026-109619. It is not a complete mitigation, and the PHP maintainers say updating is the only safe choice.

My site runs PHP 7.4 or 8.1. Is it affected?

Very likely. Wiz reports versions back to 5.4 are affected, and the PHP project only fixes 8.2 and newer. Move to a supported branch, or ask your Linux distribution or host for a patched build.

Sources

• CISA: Critical vulnerabilities in PHP require immediate patching
• Wiz Research: PHP2Shell
• watchTowr: PHP2Shell FAQ and exploitation notes
• SecurityWeek: PHP2Shell patches land as first exploitation attempts hit sensors
• Infosecurity Magazine: exploitation attempt detected before disclosure
• Rapid7: CVE-2026-109618 and CVE-2026-109619
• The Hacker News: ClickFix campaign on compromised sites

Last updated: 23 October 2026