Harisl Ltd.
Back to Blog
PHP2Shell
October 23, 2026
Harisl Team

PHP2Shell: The Critical PHP Flaw Threatening Every Business Website — Is Yours Already Compromised?

PHP2Shell: The Critical PHP Flaw Threatening Every Business Website — Is Yours Already Compromised?

What Is PHP2Shell and Why Is Everyone Talking About It?

On October 21, 2026, the PHP language — powering roughly three-quarters of the web — shipped an emergency security release for two critical flaws: CVE-2026-109618 and CVE-2026-109619. Researchers dubbed them "PHP2Shell" because a successful attack hands the intruder an actual shell on your website's server.

The numbers tell the story: CVSS 9.2 out of 10, exploitable without any login, and affecting any PHP version serving web requests (FPM, mod_php, or php-cgi) below the patched releases. Worse, the flaws leaked before the official disclosure — a leaked Hacker News post on the morning of October 20 forced the PHP team to ship early — so attack attempts began before the fix even existed. Cloudflare and WatchTowr recorded early exploitation, and Amazon's MadPot honeypots caught the first attempt on October 17, four days before disclosure.

Why Should Any Business Owner Care?

This is a flaw in the core of the PHP language itself — it fires before any of your site's code, and before any application firewall like Wordfence. That means:

  • WordPress and plugin updates will not protect you. The only officially recognized fix is updating PHP on the server itself.
  • Older PHP releases will never get a fix. From PHP 8.1 downward there is no official patched release — sites still running them have no remedy short of upgrading.
  • The attacker needs no password. The flaw is remotely exploitable without authentication, and the prime targets are business websites and online stores carrying customer data and payments.

Is Your Company's Website at Risk? Ask These Questions

  1. What PHP version runs our website? — Only 8.5.12, 8.4.27, 8.3.36, or 8.2.35 are safe. Anything below them is exposed.
  2. Was the patch applied AND PHP restarted? — Patching alone is not enough; PHP services must be restarted for the fix to take effect.
  3. Does our server accept PHP requests directly from the internet? — If yes without an updated WAF, this is a today-not-tomorrow priority.
  4. Did we check the logs for compromise signs? — Attacks began before the patch, so even patched sites may have been hit during the exposure window.

Urgent Protection Steps

  • Upgrade PHP immediately to a fixed release (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), then restart every PHP worker.
  • Enable WAF protection (such as the Cloudflare rules issued for this flaw) as temporary mitigation — it never replaces the patch.
  • Inspect your site's files and logs for unknown files or unexplained changes, especially from the pre-patch period.
  • Verify your backups are intact and restorable.
  • If you're on end-of-life versions (7.4, 8.0, 8.1 or older), plan a full upgrade, not a bandage — every day of delay widens the risk window.

The Bigger Lesson for Your Business

PHP2Shell is a reminder every business owner should internalize: a website is not a project that ends at launch — it is a digital asset that needs ongoing security care, because the gap between a maintained site and a neglected one shows in moments like this. And the picture is bigger than one flaw: from infrastructure layers to AI agent security, protection is now a system, not a single step.

At Harisl, we build on security from day one: modern supported versions, web development and website design to current standards, secure app development, e-commerce stores that protect your customers' data and payments, and software solutions with periodic maintenance plans that catch vulnerabilities before attackers do.

Unsure about your site's current state? Start with a quick security review — you'll find clear answers in our FAQ. Prevention is far cheaper than a breach.