PHP2Shell 2026: How Critical PHP Vulnerabilities Are Threatening Every Website — And What to Do Right Now

Introduction

On October 21, 2026, the web development world woke up to one of the most severe security disclosures in internet history.

Two critical vulnerabilities — designated CVE-2026-109618 and CVE-2026-109619, collectively named PHP2Shell — were publicly disclosed in the core PHP language runtime. With a CVSS severity score of 9.2 out of 10, both vulnerabilities allow attackers to execute code on a web server without any authentication whatsoever.

No login required. No credentials needed. Just an exposed PHP installation and an exploit — and millions of websites were at risk before most business owners had any idea what was happening.

The scale of the exposure is staggering. PHP powers approximately 70% of all websites on the internet. Palo Alto Networks identified over 22.6 million exposed instances potentially vulnerable at the time of disclosure. Within hours of the public announcement, active exploitation attempts were already being recorded in the wild.

And two days later, the situation became even more complicated — a third vulnerability, CVE-2026-115560, was disclosed, this one currently unpatched.

If your business has a website — particularly one built on PHP-based platforms like WordPress, Drupal, Laravel, or any PHP-powered CMS — you need to understand exactly what happened, what it means for your business, and what steps protect you right now.

At GravityOne Solutions, we build and maintain modern, secure web applications for businesses across industries. This guide is our clear, straightforward breakdown of the PHP2Shell crisis — and how we help businesses move forward from it safely.

What Is PHP2Shell? Breaking Down the Vulnerabilities

PHP2Shell is the name given to a pair of critical remote code execution (RCE) vulnerabilities discovered in PHP's core engine by Wiz Research — the same team that discovered them using advanced AI-assisted security analysis tools in August 2026.

The vulnerabilities were reported to the PHP security team on August 24, 2026. Fixes were developed over the following weeks and released on October 21, 2026. However, details leaked on social media on October 20 — meaning attackers had a window of active exploitation before patches were widely deployed.

CVE-2026-109618 — Out-of-Memory Corruption (CVSS 9.2)

This vulnerability stems from how PHP handles out-of-memory (OOM) errors. When PHP encounters an out-of-memory condition, it uses a longjmp() function to interrupt normal execution — but this leaves request memory in a partially initialized state. PHP's request cleanup process then treats this invalid, uninitialized data as valid — creating a condition that attackers can reliably exploit to execute arbitrary code on the server.

In plain terms: An attacker can trigger an out-of-memory condition in a PHP application and use the resulting unstable memory state to run any code they want on your web server — without logging in, without authentication, without any legitimate credentials.

CVE-2026-109619 — Stale Global State (CVSS 9.2)

This vulnerability relates to how PHP manages global memory state across requests when using PHP-FPM (FastCGI Process Manager) — the most common way PHP is deployed in modern web hosting environments.

When a request ends in an error, PHP's longjmp() fatal error handler leaves global memory pointing to regions that have already been freed. A subsequent request handled by the same worker process may then read or branch on that stale, freed memory — enabling attackers to execute arbitrary code through carefully crafted sequential requests.

In plain terms: An attacker can send a sequence of requests to a PHP server that causes it to access freed memory and execute their code — again, without any authentication.

CVE-2026-115560 — The Third Vulnerability (Currently Unpatched)

Two days after the PHP2Shell fixes were released, the PHP Foundation disclosed a third vulnerability — CVE-2026-115560 — which could allow code execution in web applications using unusual PHP session settings. As of publication, this vulnerability has no patch. The PHP Foundation's guidance is to disable the session.upload_progress feature as an immediate mitigation.

No exploitation of CVE-2026-115560 has been confirmed yet — but the existence of a third unpatched flaw days after an emergency patch cycle underscores how serious and ongoing this situation is.

Who Is Affected?

The scope of PHP2Shell is exceptional because it affects the core PHP runtime itself — not a specific plugin, theme, or application. This means:

• Every PHP installation serving web requests is potentially at risk

• Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed

• The PHP team considers mod_php the highest-risk setup

• All PHP versions from 5.4 through 8.5.11 are affected by at least one vulnerability

• End-of-life PHP branches (8.1 and older) will not receive official patches

Platforms built on PHP include:

• WordPress (powers 43%+ of all websites globally)

• Drupal

• Joomla

• Magento / Adobe Commerce

• Laravel applications

• Symfony applications

• Custom PHP-built websites and portals

If your website runs on any of these platforms and has not been updated to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, your site remains at risk.

What Can Attackers Do With These Vulnerabilities?

Remote code execution at the server level is one of the most severe outcomes in cybersecurity. With PHP2Shell, a successful attacker could:

• Take complete control of your web server

• Steal all data stored or accessible by your application — customer data, business records, financial information, credentials

• Install malware or backdoors that persist after patching

• Deface or destroy your website

• Use your server as a launching point for attacks on other systems

• Exfiltrate sensitive client data — a potentially catastrophic compliance and legal exposure for businesses in regulated industries

• Encrypt your data for ransomware — demanding payment to restore access

For businesses in real estate, healthcare, legal, and financial services — where client data sensitivity is at its highest — the consequences of an unmitigated PHP2Shell exploitation could be severe and far-reaching.

The Exploitation Timeline: How Fast Did This Move?

The PHP2Shell timeline reveals how quickly vulnerabilities at this severity level are weaponized:

The critical takeaway: attackers were exploiting these vulnerabilities before most website owners knew they existed. If your PHP installation is not patched and your server logs have not been reviewed for signs of compromise, the window of exposure may already have passed.

Immediate Steps Every Website Owner Should Take

Step 1: Update PHP Immediately

Upgrade to one of the patched versions released October 21, 2026:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

If you are on PHP 8.1 or older — end-of-life versions that will not receive official patches — migrating to a supported version is urgent.

Step 2: Disable Session Upload Progress

As a mitigation for the unpatched CVE-2026-115560, set the following in your PHP configuration: session.upload_progress.enabled=0

Step 3: Review Server Logs

Check your server access and error logs from October 17 onward for unusual request patterns, unexpected file writes, or anomalous process spawning that could indicate exploitation attempts.

Step 4: Audit Your Hosting Environment

Confirm with your hosting provider whether PHP has been patched on your server. Shared hosting environments depend on the provider to deploy patches — do not assume it has been done automatically.

Step 5: Consider a Web Application Firewall (WAF)

A properly configured WAF can provide an additional layer of protection against exploit attempts targeting PHP vulnerabilities while patching is in progress.

How GravityOne Solutions Protects Your Web Presence

At GravityOne Solutions, our web development practice is built on one foundational principle: security is not an afterthought — it is the architecture.

Every website and web application we build is engineered from the ground up with security as a first-order concern — not something layered on after launch.

We Build on Secure, Modern Technology Stacks

PHP remains a powerful and widely used language — but the PHP2Shell crisis illustrates why the technology stack your web presence is built on, and how it is maintained, matters enormously.

At GravityOne Solutions, our development team works across:

• Laravel — The leading PHP framework with a strong security architecture, active maintenance, and a dedicated security team that deploys patches rapidly. Our Laravel applications are built with secure-by-default practices that significantly reduce the attack surface beyond what vanilla PHP exposes.

• Vue.js — Our frontend framework of choice for modern, reactive web applications — cleanly separated from the server-side layer and engineered for performance and security.

• WordPress (hardened) — For clients who need CMS-driven websites, we build on WordPress with security hardening practices — updated core, minimal plugin footprint, proper file permissions, and regular patch management.

• HTML, CSS & JavaScript — For projects where a static or near-static site is appropriate, we build lean, minimal-attack-surface solutions that eliminate server-side PHP exposure entirely.

We Provide Ongoing Security Maintenance

The PHP2Shell crisis is not a one-time event. Critical vulnerabilities in widely used technologies will continue to emerge — and the businesses that are protected are the ones with a development partner actively maintaining their web presence.

GravityOne Solutions provides ongoing post-launch support that includes:

• PHP and framework version monitoring and updates

• Security patch deployment

• Regular server configuration review

• Web application firewall configuration support

• Security audit support for businesses that need to confirm the integrity of their existing web presence

We Help Businesses Recover and Rebuild

If your website has been compromised — or if you are running an unpatched, vulnerable PHP installation and need to act fast — GravityOne Solutions can help you:

• Conduct a technical assessment of your current web presence

• Identify the safest and most efficient path to a secure, modern solution

• Rebuild your website or web application on a secure, actively maintained technology stack

• Implement security best practices from day one of the new build

• Provide ongoing maintenance so this situation is never repeated

We are currently onboarding new clients affected by the PHP2Shell crisis. If your business needs a reliable, experienced web development partner to help you navigate this — we are ready to help.

➡️ Contact GravityOne Solutions — Let's Secure Your Web Presence