PHP2Shell: What companies need to know now about the critical PHP vulnerability

PHP2Shell is the name for two critical security vulnerabilities in the programming language PHP (CVE-2026-109618 and CVE-2026-109619), which were published on October 21, 2026. They allow attackers to execute malicious code on web servers without logging in and without any user interaction. The BSI classifies the situation as warning level 3/Orange: measures must be taken immediately. The only effective protection is updating to a patched PHP version.

PHP powers a large part of the internet: WordPress, TYPO3, Joomla, Drupal, Shopware and Magento, but also the web interfaces of firewalls, routers and network storage systems. That is why PHP2Shell affects not only IT departments, but almost every company with its own website. This article summarizes what happened and what you should do now. Status: October 24, 2026.

What happened?

On October 20, the PHP developers announced a critical security update at short notice after details had become known in advance. On October 21, the patches and technical descriptions followed. According to Amazon Threat Intelligence, there had already been an attempted attack on October 17, i.e. before the release. The vulnerabilities were discovered, among others, by the security firm Calif as part of a project with OpenAI and, independently of that, by Wiz — each with support from AI models.

The key facts

Who is affected?

• Websites and shops based on PHP, such as WordPress, TYPO3, Joomla, Drupal or Shopware – regardless of whether the CMS itself is up to date. What matters is the PHP version on the server.
• Hosted websites: With shared hosting and managed servers, the hosting provider is usually responsible for the PHP update. Ask them.
• Own servers and containers: Those who operate their own systems must update PHP and rebuild Docker images.
• Devices with web interfaces:According to the BSI, products from F5, Citrix NetScaler, Palo Alto, OPNsense, pfSense, QNAP, Synology and cPanel, among others, are at least partially affected. In these cases, only firmware updates from the manufacturers will help.

What you should do now

1. Inventory: Which websites, shops, servers and devices with web interfaces do you operate? PHP as part of other software also counts.
2. Check PHP version and update to a patched version. How to do this is shown by Is my website affected?.
3. Ask hosting providers and service providers, whether the updates have been installed – in writing, with version number.
4. Update device firmware,as soon as the manufacturers provide updates.
5. If no update is possible: The BSI recommends considering a temporary disconnection from the internet, as workarounds do not provide complete protection.
6. Check for traces of an attack, such as new PHP files or unusual processes. Details in Website hacked?.

Why this is happening so quickly this time

The BSI points out that attackers can use AI-powered tools to analyze patches in a short time and develop attacks from them. It considered broad exploitation within a few hours of the patches being released likely. The time between publication and attack is therefore shrinking. Updates “at some point in the next few weeks” are no longer enough.

A web application firewall is not enough

Providers such as Cloudflare have published rules against known attack paths. A web application firewall (WAF) can make attacks more difficult, but according to the BSI and the US agency CISA, it does not replace an update. Only patching or disconnecting from the internet provides complete protection.

Unsure whether your website, your online shop, or your devices are affected? Get in touch with us. We review your systems, install updates, and tell you honestly what needs to be done – even if it turns out that everything is fine. To get started, all you need is a brief conversation.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). They allow attackers to execute malicious code on web servers running PHP without logging in. The name is a reference to the well-known Log4Shell vulnerability.

Which PHP versions are safe?

Patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For the no-longer-supported versions 7.4, 8.0, and 8.1, backport patches are available; Linux distributions sometimes provide their own backported updates.

Is my WordPress site affected?

If it runs on a server with an unpatched version of PHP, yes. A WordPress update alone is not enough, because the vulnerability is in PHP itself. What matters is whether your hosting provider has updated PHP.

Is it enough if my hosting provider takes care of it?

With shared hosting, the hosting provider is usually responsible. Nevertheless, have them confirm that the updates have been applied, and also check whether you operate your own servers or devices with a web interface.

As of: 24 October 2026. Sources: BSI security advisory on PHP2Shell, CISA.