A server rack in a dark data centre with one panel torn open and red light and streams of data pouring out

PHP2Shell: the critical PHP flaw affecting most of the web, and what to do about it

Oliver (Olly) is the founder and Managing Director of PWD Digital Agency, which he started in Perth in 2007. With nearly two decades in digital marketing, Oliver and his team specialise in SEO, Google Ads, web design, and conversion-focused digital strategy for Australian businesses.

22nd October 2026

A critical set of PHP vulnerabilities, dubbed PHP2Shell, was publicly disclosed on 21 October 2026 by the Wiz Research team. The flaws sit in PHP’s core engine, which means they affect nearly every PHP website on the internet, including sites built on WordPress, Joomla and Drupal. According to Wiz, PHP powers about 70 per cent of all websites, so if you run a business website, there is a very good chance this applies to you.

What is PHP2Shell?

Wiz Research found four memory-safety bugs in the way PHP handles fatal errors, grouped under two CVEs (CVE-2026-109618 and CVE-2026-109619) with a severity rating of up to CVSS 9.2. Attackers can trigger the flaws remotely with crafted requests, no login required.

In plain terms, the bugs allow an attacker to:

Read your server’s memory remotely, potentially exposing passwords, session tokens, API keys and certificates belonging to you and your visitors
Run their own code on your server in some configurations, giving them full control of the site

The researchers demonstrated working attacks against up-to-date WordPress, Drupal and Joomla installations. Importantly, your website’s own code does not need to have any flaws. The vulnerability is in PHP itself, so even a perfectly built site on an unpatched server is exposed.

Who is affected?

Almost everyone running PHP. The bugs go back as far as PHP 5.4, and every PHP release of the past decade contains at least one of them. Patched PHP versions were released on 21 October 2026 alongside the disclosure.

What you should do now

Update PHP to the patched releases published on 21 October 2026. This is the only complete fix.
On managed hosting? Most Australian small-business sites are. Contact your host and ask them to confirm they have rolled out the patched PHP versions. Major providers including Cloudflare, Google, Microsoft, AWS and Akamai have shipped mitigations for sites running behind their networks, but these do not replace updating PHP.
Check your logs for warning signs: unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained PHP worker restarts.

Not sure where your site stands?

Most business owners do not know what PHP version their site runs, and that is completely normal. It is your hosting provider’s job, but it is worth confirming rather than assuming. If you would like us to check your site and hosting setup, get in touch and we will take a look.

You can read the full technical write-up on the Wiz Research blog.

More From Our Blog

A custom brass key fitted neatly into a lock on a workshop bench beside a bundle of mismatched generic keys tied with string, showing bespoke software versus off-the-shelf workarounds

Custom Software Audit: How to Tell If Your Off-the-Shelf Tools Are Costing You Growth

If your team is duct-taping spreadsheets to your off-the-shelf software just to get through the week, that’s not a workflow problem — it’s a growth ceiling. A custom software audit gives you the framework to prove it, and the data to decide whether bespoke is worth building.

A worn wooden toolbox holding a few essential tools beside an empty ornate gilded display case, contrasting what a small business website needs with costly upsells

Small Business Web Design in Perth: What You Actually Need vs What Agencies Upsell

Most small business websites in Perth are loaded with features that look impressive and do nothing for leads, while missing the handful of things that actually convert visitors into customers. Here’s the blunt, cost-conscious breakdown of what’s essential and what’s padding, from an agency that builds for local trades and ASX-listed companies under the same roof.

Five coloured threads on separate spools on a wooden workbench, woven into one strong braided rope, showing web, SEO and ads combined under one accountable team

One Team or Five Invoices? The Real Cost of Splitting Web, SEO and Ads Across Agencies

Splitting web, SEO and paid media across three separate vendors feels like specialisation, but it usually just means nobody owns the result. Here’s what that handoff actually costs a marketing manager, and why one in-house team changes the maths.