Last updated: 23 October 2026
A flaw hiding in plain sight
Two critical weaknesses sat inside PHP, the language behind a large share of the world's websites, for more than ten years. No one noticed them until AI-assisted security research brought them to the surface in October 2026.
The discovery, now known as PHP2Shell, triggered one of the fastest coordinated responses the internet has seen. Within 48 hours, the PHP project shipped emergency fixes, national cyber agencies from Washington to New Delhi issued alerts, and several public-sector websites in Europe went offline as a precaution.
This explainer breaks down what happened, why it matters, and what website owners, businesses and everyday users should do now.
PHP in one minute: the engine you never see
PHP (short for PHP: Hypertext Preprocessor) is an open-source, server-side scripting language that has powered websites since the mid-1990s. It runs on the web server, not in your browser, so most people use it every day without knowing it exists.
Think of a bank branch. A static web page is like a printed brochure: everyone gets the same copy. A PHP-driven page is more like a teller who checks your account, pulls your latest entries and prints a fresh statement just for you. PHP does that assembly work behind the scenes, then hands your browser a finished page.
That flexibility made PHP the backbone of popular platforms such as WordPress, Drupal, Joomla and Magento, and frameworks such as Laravel and Symfony. Security firm Wiz, one of the teams behind the discovery, estimates PHP runs roughly 70% of websites worldwide. Treat that as an industry estimate rather than an audited count, but it explains why a flaw in PHP itself rattled so many organisations at once.
What exactly is PHP2Shell?
PHP2Shell is the nickname for two separate flaws in the core of PHP. Both let an attacker run their own code on a web server remotely, without logging in. Security professionals call this unauthenticated remote code execution (RCE), the most serious class of vulnerability there is.
| Identifier | What goes wrong, in plain terms | Severity | | --- | --- | --- | | CVE-2026-109618 | When a server runs short of memory mid-request, PHP can stop halfway through setting up data, then later treat that half-built data as valid. An attacker can engineer this to take control. | Critical, CVSS v4.0 score 9.2 | | CVE-2026-109619 | Leftover data from one visitor's request can linger in memory after it should have been cleared. The next request on the same server process can then misuse it. | Critical, CVSS v4.0 score 9.2 |
Three things made this unusually serious:
- It is in PHP itself. The problem is not a buggy plugin or theme, so updating WordPress or its add-ons does not fix it. Only a patched PHP version does.
- It is old. The affected code reaches back to PHP 5.4, released in 2012, so a decade's worth of installations carry it.
- It is broad. Advisories list common server setups as affected, including PHP-FPM, Apache with
mod_php, php-cgi, FrankenPHP and LiteSpeed.
If successfully exploited, an attacker could plant hidden backdoors, steal databases holding customer records, or use the compromised server to attack others.
How AI found what humans missed
The flaws were uncovered by researchers at security firms Calif and Wiz, working with OpenAI and the PHP security team. They used advanced AI models that can read and reason about very large codebases far faster than a human reviewer.
The bugs themselves were not new. What changed was the ability to find them. Proving these particular flaws were exploitable required a long, intricate chain of steps that researchers described as near the limit of what humans could practically do by hand. AI made that chain tractable.
The disclosure did not go to plan. Details leaked online on 20 October 2026, ahead of the scheduled announcement, which forced the PHP team to bring its release forward. Patches went live on 21 October at around 14:00 UTC, which was 7:30 PM in India.
This is the double edge of AI in security. The same tools that help defenders find hidden bugs can help attackers turn a published flaw into a working exploit within hours. Expect more discoveries of this kind, and faster attacks after each one.
The global response, and India's alert
The response was swift and unusually public. Agencies did not just advise patching; several told organisations to take sites offline if they could not patch quickly.
| Date (2026) | What happened | | --- | --- | | 22 Oct | CERT-In updated its note, citing multiple reports of large-scale exploitation. Security firm watchTowr confirmed attacks in the wild. | | 21 Oct | PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-In issued vulnerability note CIVN-2026-0510, rated critical. The US NSA, CERT-EU and agencies in South Korea, Japan and Singapore issued alerts. | | 20 Oct | Technical details leaked online. PHP warned administrators to prepare for an emergency update. | | 17 Oct | Amazon's threat intelligence honeypots logged an exploitation attempt, four days before public disclosure. |
Attack traffic climbed sharply once the details became public. Cloudflare reported exploitation attempts rising from thousands before disclosure to millions shortly after. Public-sector sites in Finland, the Netherlands, Belgium and France were taken fully or partly offline, many as a precaution rather than because of a confirmed breach.
For Indian organisations, CERT-In's note is the key reference. It applies to any public-facing website, online store, customer portal or API built on PHP, whether you host it yourself or a vendor manages it. At the time of writing, no specific Indian victims had been publicly identified, but being exposed is reason enough to act.
What website owners and businesses should do now
The only complete fix is upgrading PHP. The PHP team has said no configuration change fully closes these flaws, so treat temporary workarounds as a stopgap, not a solution.
- Find every PHP system you run. Include public websites, admin panels, internal tools, staging servers and container images. PHP often hides inside content-management systems and vendor appliances.
- Check the version. Running
php -von the server, or asking your host, tells you where you stand. - Upgrade to a fixed release. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching the branch you use.
- Restart everything that loads PHP. Running processes keep the old, vulnerable code in memory until they restart. Restart PHP-FPM and Apache, and rebuild container images.
- Plan for older versions. PHP 8.1 and earlier get no official fix. Upgrade to a supported branch, or use a commercial extended-support provider in the meantime. Roughly 8.84 lakh internet-facing hosts were still advertising one of these unsupported versions, by one industry count.
- Check for signs of compromise. Because attacks began before disclosure, look for unfamiliar files, new admin accounts or unexpected outbound connections, and review server logs from mid-October onward.
- Take it offline if you cannot patch. CERT-EU, the NSA and others advise temporarily isolating or suspending exposed systems that cannot be secured promptly.
If an agency or hosting company runs your site, ask them in writing whether the PHP2Shell fixes have been applied and the services restarted. On shared hosting, your security depends on how fast your provider acts, so expect a clear, documented answer.
What it means for everyday users
If you simply browse websites, there is nothing to install. PHP2Shell sits on web servers, so the responsibility for fixing it lies with the organisations that run those servers.
You can still protect yourself with a few sensible habits:
- Follow genuine instructions. If a service you use asks you to reset your password after this incident, do it through its official app or website.
- Watch for opportunistic scams. Fraudsters often exploit headline security news. Be wary of emails, SMS or WhatsApp messages that mention a "PHP security alert" and ask you to click a link, share an OTP or install software.
- Keep an eye on your accounts. Review bank, card and investment statements for anything you do not recognise, and report suspicious activity to your bank or at the national cybercrime portal, cybercrime.gov.in.
The bigger lesson for regulated industries
PHP2Shell is a reminder that the riskiest software is often the oldest and most trusted. Much of the web's foundation was built for functionality first, with security added later. AI is now exposing those gaps faster than ever, and attackers have the same tools.
For banks, NBFCs, insurers, brokers and wealth platforms, three practical takeaways stand out:
- Know your software inventory. You cannot patch what you cannot see. An up-to-date list of every component, including third-party and vendor systems, turns a scramble into a checklist.
- Shrink the patch window. The gap between disclosure and mass exploitation is now measured in hours. Emergency patching needs a pre-agreed process, owners and approval paths.
- Hold vendors to the same standard. Customer data often sits on platforms managed by partners. Contracts and reviews should cover how quickly they patch critical flaws and how they report incidents.
Indian regulated entities already operate under frameworks such as SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) and CERT-In's directions on incident reporting. An event like PHP2Shell is a live test of whether those processes work in practice. Teams should confirm their specific obligations with their compliance and information-security functions.
Frequently Asked Questions
What is PHP2Shell?
It is the name for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619. Both can let an attacker run code on a web server without logging in.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Versions 8.1 and older receive no official fix.
Is my WordPress site affected?
It may be, if the server runs a vulnerable PHP version. Updating WordPress, themes or plugins does not fix this; the PHP runtime itself must be upgraded.
Did CERT-In issue an advisory?
Yes. CERT-In published vulnerability note CIVN-2026-0510 on 21 October 2026, rated critical, and updated it on 22 October.
Do I need to do anything as an internet user?
No installation is needed. Stay alert to phishing that uses this news as bait, and follow only official password-reset requests.
What was AI's role?
Researchers used advanced AI models to analyse PHP's code and prove the flaws were exploitable, a task that was impractical by hand.
Sources and disclaimer
Facts in this article were drawn from the following public sources, as of 23 October 2026:
- Help Net Security: PHP2Shell patches and CVE details
- BleepingComputer: PHP ships emergency patches
- watchTowr: PHP2Shell FAQ and exploitation status
- TuxCare: patches for end-of-life PHP versions
- Armis: finding and patching affected systems
- Safeguard: how Asian agencies, including CERT-In, responded
- Free Press Journal: CERT-In alert and Indian websites
- Techmitra: how to check whether your site is patched
For official guidance, refer to the PHP security advisory at php.net and CERT-In note CIVN-2026-0510 at cert-in.org.in. Exposure figures are industry estimates and may change as investigations continue.
This article is for general awareness only and does not constitute technical, legal or compliance advice. Organisations should consult their IT security teams or service providers before making changes to production systems.
