PHP Security Crisis 2026: Two Critical Vulnerabilities Put Websites Worldwide at Risk
A major cybersecurity crisis has emerged involving PHP, one of the most widely used programming languages on the internet. Two critical security vulnerabilities have raised serious concerns among website owners, hosting providers, developers and cybersecurity experts.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code remotely on vulnerable servers without requiring authentication.
The vulnerabilities have collectively been called PHP2Shell. Following their discovery, the PHP development team released emergency security updates on October 21, 2026.
Several organisations worldwide temporarily took their websites offline as a precaution while preparing security fixes.
What Is PHP?
PHP stands for Hypertext Preprocessor. It is an open-source server-side programming language used to create dynamic websites and web applications.
PHP works on the server. When a visitor opens a website, PHP processes information and generates the content that appears in the visitor's browser.
It is widely used for:
- Website development.
- User registration and login systems.
- Database management.
- Online shopping websites.
- Content management systems.
- Dynamic web applications.
- News portals and blogging platforms.
One of the most popular platforms built using PHP is WordPress, which powers a significant portion of websites worldwide.
What Is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities discovered in the PHP programming language.
These security problems involve how PHP handles memory during certain abnormal request-processing situations.
Under specific conditions, attackers could exploit these weaknesses to execute arbitrary code on affected servers.
An attacker may be able to send a specially crafted request to a vulnerable server and execute malicious instructions without logging into the website.
Two Critical PHP Vulnerabilities Explained
1. CVE-2026-109618 – Out-of-Memory Corruption
The first vulnerability is related to how PHP handles memory exhaustion during request processing.
When PHP runs out of memory, it may interrupt an operation before internal information has been properly initialised.
Under certain conditions, the cleanup process may incorrectly handle this information, creating an opportunity for attackers to exploit the server.
2. CVE-2026-109619 – Stale Global State
The second vulnerability involves internal information that remains referenced after the memory containing it has been released.
A later request may incorrectly use this outdated information, potentially creating a memory-management weakness.
Both vulnerabilities can create serious security risks, including remote code execution.
Which PHP Versions Are Affected?
The PHP development team released security updates on October 21, 2026, to address the vulnerabilities.
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Earlier versions of these PHP branches are affected. PHP 8.1 and older versions are also vulnerable, but they are no longer supported by the main PHP project.
Administrators using older versions should consult their operating system or hosting provider for available security patches, or migrate to a supported PHP release.
Why Did Websites Go Offline?
The vulnerabilities created concerns because attackers could potentially compromise internet-facing PHP servers.
As a precaution, several organisations temporarily suspended online services while checking their systems and preparing security updates.
Some of the affected organisations and services reported in news coverage included:
- Japan's Finance Ministry.
- BambooHR.
- The Port of Rotterdam.
- Wikimedia Foundation services.
Temporarily taking a website offline can reduce exposure when administrators cannot immediately install the required security updates.
Can Hackers Take Control of PHP Websites?
Remote code execution is considered one of the most serious types of software vulnerabilities.
If attackers successfully exploit a vulnerable PHP installation, they may be able to execute commands with the permissions of the PHP server process.
Depending on server configuration, this could potentially expose:
- Website files and source code.
- Database information.
- Uploaded documents and images.
- Application configuration files.
- User information and credentials accessible to the server.
However, this does not mean every PHP website has been compromised. Actual impact depends on the affected PHP version, server configuration and successful exploitation.
Does This Security Crisis Affect WordPress?
WordPress is built primarily using PHP. Therefore, websites running WordPress on vulnerable PHP server environments may also be affected.
Updating WordPress themes and plugins alone will not fix vulnerabilities in the PHP runtime.
Website owners should:
- Check their current PHP version.
- Contact their hosting provider.
- Install the appropriate PHP security update.
- Restart PHP services where necessary.
- Check website files and server logs for suspicious activity.
How to Protect Your Website from PHP2Shell
1. Update PHP
Install a patched PHP release as soon as possible. Updating to a fixed version is the most important security measure.
2. Contact Your Hosting Provider
If you use shared hosting, contact your hosting company and ask whether your PHP environment has received the necessary security patches.
3. Check Your PHP Version
You can check the PHP version using your hosting control panel, cPanel or hosting provider's PHP configuration section.
4. Monitor Server Logs
0 Comments