PHP2Shell Vulnerability: How Many Websites Are Actually Exposed?

The short answer: how bad is PHP2Shell?

PHP2Shell is one of the broadest PHP security events in years, because the bugs sit in PHP’s core engine rather than in one plugin or app. PHP’s own advisory says all PHP installations serving web requests are at risk, with mod_php the highest risk. The patch exists; the problem is the long tail of old PHP that will never get an official one.

The search spike is justified. On 21 October 2026 the PHP project shipped emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two vulnerabilities it rates CVSS v4.0 9.2. Germany’s BSI reportedly issued its orange level 3 warning, the UK NCSC told organisations to take systems offline if they cannot patch or mitigate, and councils and government sites in several countries were pulled offline as a precaution.

The exposure question is where headlines blur. 69.3% of websites with a known server-side language use PHP (W3Techs), but not every PHP site is exploitable in practice, and some old-looking servers carry patches backported by Linux distributions. Our best estimate: about 48% of PHP websites run PHP 8.1 or older, branches the PHP project no longer updates. That is roughly one in three websites overall.

What is PHP, and why does one bug affect so many websites?

PHP is the programming language that builds web pages on the server before they reach your browser. It powers WordPress, which alone runs 39.6% of all websites (W3Techs), plus Drupal, Joomla and countless custom sites. A flaw in PHP itself can therefore reach sites whose own code is perfectly fine.

When you open a WordPress blog or an online shop, the server runs PHP code that fetches content from a database and assembles the page. You never see PHP directly; you only see the HTML it produces. That is why 'what is php' is trending alongside 'php vulnerability': many site owners are discovering this week that their site depends on it.

Most security news concerns a single plugin or application. PHP2Shell is different. Wiz Research says the flaws are in PHP’s core engine, so even a simple 'Hello World' page on an affected version can be vulnerable. Wiz built an exploit that achieved unauthenticated remote code execution on the latest WordPress, Drupal and Joomla container images at the time of testing.

What exactly is PHP2Shell? CVEs, scores and dates

PHP2Shell is the name researchers gave to two PHP flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 by the PHP project. Both are memory-handling bugs triggered by fatal errors such as running out of memory, and both can allow an attacker without a login to run code on the server.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via out-of-memory corruption. PHP’s advisory: out-of-memory handling can interrupt PHP while internal request data is only partially initialised, and request cleanup may then treat the invalid data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state. Request-owned internal state can survive after its memory has been freed, and a later request handled by the same worker may use that stale state. Researchers also showed this can leak worker memory, which may contain passwords, tokens and API keys.
• Severity. PHP’s advance notice rated both CVSS v4.0 9.2. Wiz says four separate bugs are grouped under the two CVEs.
• The name. 'php2shell' was the name of Wiz’s combined exploit script; it became the shorthand for both CVEs. It is not an official PHP term, but the CVE IDs behind it are confirmed on php.net.

Timeline (as of 23 October 2026). Wiz says it found the first bug on 19 August 2026 and reported to the PHP security team on 24 August. On 20 October, details leaked on social media according to watchTowr, and PHP posted an advance notice of a critical release for 21 October at 14:00 UTC. Decrypt reports the release was brought forward from 22 October because of the leak. On 23 October PHP added an informational advisory recommending `session.upload_progress.enabled=0` until the next bugfix release, tied to a further identifier, CVE-2026-115560.

Which PHP versions and server setups are affected?

Effectively every PHP version in use is affected: Wiz says releases back to PHP 5.4 carry at least one of the bugs. Official fixes exist only for PHP 8.2 to 8.5. PHP names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as affected and rates mod_php the highest risk.

Unlike 2024’s CVE-2024-4577, which needed Windows plus CGI mode, PHP2Shell is not limited to one operating system or one setup. PHP’s advisory says 'all PHP installations serving web requests' are at risk. For Apache mod_php it describes a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.

PHP-FPM, the common setup behind Nginx and many managed hosts, is not safe either. Qualys notes that FPM’s startup behaviour blocks one specific out-of-memory path, but the session-handling route was validated against FPM under suitable application conditions.

• PHP 8.2, 8.3, 8.4, 8.5: fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (21 October 2026).
• PHP 7.4, 8.0, 8.1: no official release. PHP published minimal source backports for people who build from source; otherwise use your Linux distribution, an LTS vendor, or upgrade.
• PHP 7.3 and older, including PHP 5: no fix from PHP. watchTowr confirmed PHP 5 is affected. Upgrade, or rely on a distribution that still backports.
• Bundled PHP in appliances: Help Net Security reports Palo Alto Networks said all PAN-OS and Panorama versions are affected, while Fortinet and Cisco were still checking products.

Is PHP2Shell being exploited in the wild?

Exploitation attempts have been observed, but no successful compromise had been publicly confirmed as of 22–23 October 2026. watchTowr’s honeypots saw attempts from 21 October, Amazon reported an attempt on 17 October, before disclosure, and Cloudflare reported attack traffic. PHP2Shell was not on CISA’s Known Exploited Vulnerabilities list as of 22 October, per watchTowr.

Help Net Security reports that Amazon’s MadPot honeypot recorded an exploitation attempt on 17 October 2026, four days before public disclosure, from an IP tied to a commercial anonymisation service. How the attacker obtained details is unknown. watchTowr says its honeypot network has seen exploitation in the wild since 21 October; Dark Reading quotes watchTowr saying no attempt had succeeded yet.

A public detector already exists: Searchlight Cyber released an open-source php2shell-scanner. Cloudflare has deployed initial WAF rules, including for free customers, though Qualys notes attackers have tried to evade those protections.

How many websites are exposed to PHP2Shell?

Estimates range from about 2.24 million internet-facing PHP hosts (Shodan) to more than 22.6 million exposed instances (Palo Alto Networks Unit 42), because they count different things. On version data, Mallory’s Shodan count found 59% of hosts that show a PHP version run a branch with no official fix.

There is no single count of 'exposed websites'. Scanners count IP addresses or services, and one shared-hosting server can carry thousands of sites. Website surveys such as W3Techs count sites, not servers, and cannot see which are patched. Read the numbers below as different lenses on the same problem.

Country data from the same scan puts the United States top for unfixed hosts at 228,770. Unit 42’s much larger 22.6 million figure was reported without methodology in the coverage we read, so we treat it as an upper-bound style count of instances rather than websites.

How many PHP sites run unsupported versions? Our estimate

About 48.3% of PHP websites run PHP 8.1 or older, which got no official PHP2Shell release, based on W3Techs version shares on 23 October 2026. Multiply by PHP’s 69.3% share and roughly 33.5% of all websites with a known server-side language are on an unfixed PHP branch.

W3Techs splits PHP sites into major versions (PHP 8: 65.3%, PHP 7: 26.9%, PHP 5: 7.7%, PHP 4: 0.1%) and splits PHP 8 into minor versions. Combining the two gives each branch’s share of all PHP sites.

• Unsupported today: 48.3% of PHP sites. PHP 4, 5 and 7 = 34.7%, plus PHP 8.0 and 8.1 = (5.8% + 15.1%) × 65.3% = 13.6%.
• As a share of all sites: about 33.5%. 48.3% × 69.3% = 33.5%, or roughly 335 of every 1,000 websites with a known server-side language.
• After 31 December 2026: about 66.4% of PHP sites. PHP 8.2 (18.0% of PHP sites) reaches end of life, so unless sites upgrade, two in three PHP sites will be on a branch that gets no future fixes.

PHP end-of-life dates: which versions are still supported?

Only PHP 8.2, 8.3, 8.4 and 8.5 are supported as of 23 October 2026, and PHP 8.2 loses security support on 31 December 2026. Anything older, including PHP 8.1 (EOL 31 December 2025) and 7.4 (EOL 28 November 2022), receives no updates from the PHP project.

If you are upgrading anyway, aim for PHP 8.4 or 8.5: both are in active support for years, while 8.2 has just over two months of security support left. PHP 8.6 is at release-candidate stage (RC4 includes the PHP2Shell fixes) and PHP says not to use it in production.

How does PHP2Shell compare with past PHP vulnerabilities?

PHP2Shell’s 9.2 score is similar to past critical PHP bugs, but its reach is wider. CVE-2024-4577 (CVSS 9.8) needed Windows plus CGI mode; CVE-2019-11043 (9.8) needed a specific Nginx plus PHP-FPM setup. PHP2Shell affects standard setups across operating systems.

Note the scoring systems differ: PHP2Shell is scored under CVSS v4.0, the older bugs under v3.1, so 9.2 versus 9.8 does not mean PHP2Shell is milder. The pattern that matters is what happened next: CVE-2024-4577 was patched on 6 June 2024, Shadowserver saw testing from 7 June, and CISA added it to KEV on 12 June. Old PHP bugs keep getting exploited for years, which is why the long tail of unsupported versions is the real risk.

Did AI find PHP2Shell faster than maintainers could fix it?

AI models were part of both the discovery and the exploit work, but the fix still took 58 days from report to release. OpenAI says its GPT-5.6 Sol model helped find the flaws, and Wiz says frontier models let researchers build working exploits in hours, which is the gap The Neuron’s headline points at.

Credit is shared and reported differently. Wiz says its researchers discovered the bugs and worked with the PHP team, Calif and OpenAI. Dark Reading and watchTowr name Calif as the discoverer. Decrypt reports Calif used GPT-5.6 Sol under OpenAI’s Patch the Planet initiative to find a version of the bug in August, OpenAI found a fuller version in September, and Wiz independently found both flaws.

The 'faster than maintainers can fix' claim is partly true. Wiz says one researcher, with AI help, did in a week what would once have taken a world-class team months. Yet the PHP side ran on human timelines: 24 August report, acknowledgement on 21 September, release on 21 October. Then patching itself lags: Qualys counted only 199,000 patched installs in the first 12 hours, about 0.13% of the 155 million versioned installs it tracks.

What should website owners do about PHP2Shell?

Find your PHP version, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or your distribution’s patched package), then restart PHP. If you cannot update today, apply PHP’s temporary mitigations and consider taking the site offline, as the UK NCSC advises.

1. 1
   Check your PHP version

   In cPanel or Plesk, look for 'Select PHP Version' or 'PHP Settings'. In WordPress, go to Tools → Site Health → Info → Server. On a server you control, run `php -v` (and check the version the web server uses, which can differ).

2. 2
   Update to a fixed release

   Target 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On Debian, Ubuntu, Red Hat and similar systems, install the distribution’s patched PHP package; it may keep an older-looking version number but include the fix.

3. 3
   Restart every PHP worker

   watchTowr and PHP stress restarting PHP-FPM, Apache or LiteSpeed after updating; old workers keep running vulnerable code.

4. 4
   If you’re on PHP 8.1 or older, plan an upgrade now

   Ask your host whether they have applied backports. Otherwise move to PHP 8.4 or 8.5, testing your plugins and theme first. PHP 8.2 itself ends support on 31 December 2026.

5. 5
   If you can’t patch today, mitigate

   PHP suggests `session.upload_progress.enabled=0` set in php.ini or server config (not `ini_set()` or `.user.ini`), `fatal_error_backtraces=0` on PHP 8.5, and tighter `post_max_size` limits. PHP says no configuration change fully mitigates the bugs; updating is the only safe choice.

6. 6
   Turn on WAF protection

   Cloudflare has published initial rules for free and paid plans; many hosts run their own WAFs. Treat this as a stopgap, not a fix.

7. 7
   Check for compromise

   The NCSC advises checking unpatched systems for backdoors. Wiz suggests looking for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 errors, oversized PHPSESSID cookies and unexplained PHP worker restarts.

PHP2Shell claims vs evidence

Frequently asked questions

How we built this analysis

• Vulnerability facts (CVE IDs, CVSS v4.0 9.2, affected SAPIs, fixed versions, mitigations, dates) are taken from php.net’s 20–23 October 2026 announcements and security advisory, cross-checked against Qualys, watchTowr, Wiz and Help Net Security.
• Branch shares of PHP sites: W3Techs (23 Oct 2026) gives PHP 8 = 65.3%, PHP 7 = 26.9%, PHP 5 = 7.7%, PHP 4 = 0.1% of PHP sites, and PHP 8 minor shares of 8.0 5.8%, 8.1 15.1%, 8.2 27.6%, 8.3 34.9%, 8.4 12.1%, 8.5 4.5%. Each 8.x share × 65.3% gives its share of PHP sites (e.g. 8.1: 15.1% × 0.653 = 9.9%).
• Unsupported share: 0.1% + 7.7% + 26.9% + (5.8% + 15.1%) × 0.653 = 34.7% + 13.6% = 48.3% of PHP sites; × 69.3% PHP share = 33.5% of websites with a known server-side language. After 8.2 EOL: 48.3% + 27.6% × 0.653 (18.0%) = 66.4%.
• Shodan host shares: 883,717 unfixed-branch hosts ÷ 1,495,986 versioned hosts = 59.1%; PHP 5.x 368,570 ÷ 1,495,986 = 24.6%.
• Patch-speed ratio: Qualys’ 199,000 patched installs in 12 hours ÷ 155 million versioned installs = 0.13%. Report-to-fix time: 24 August to 21 October 2026 = 58 days.
• Unsupported means the PHP project issues no official release for that branch; servers on those branches may still be patched by Linux distributions or LTS vendors.

Limitations

W3Techs measures shares of websites with a known server-side language, not absolute counts, and cannot see whether a site is patched or exploitable. Scanner counts (Shodan, Unit 42, Infrawatch) count hosts, instances or services, not websites, and cannot see distribution backports; about 740,000 PHP hosts hide their version. Qualys data covers its own customers only. Some details (discoverer credit, exact pre-disclosure timeline, exploitation status, CISA KEV status) were still changing as of 23 October 2026; we could not open CISA’s catalog or NVD entries directly. This article is general information, not professional security advice for your systems.

Spotted an error? See our corrections policy. Read how we work in our methodology and editorial standards.

Sources

1. PHP Group (php.net)
   Security advisory: Critical remote code execution vulnerabilities, update now (and 20–23 Oct 2026 news)CVE IDs, CVSS 9.2, affected SAPIs, fixed versions, mitigations, backports
2. PHP Group (php.net)
   Supported VersionsSupport dates for 8.2–8.5
3. PHP Group (php.net)
   Unsupported Branches (end of life)EOL dates for 8.1 and older
4. NCSC (UK)
   Critical security issue affecting PHPUK guidance, 21 Oct 2026
5. W3Techs
   Usage statistics of PHP for websites69.3% share; major version split
6. W3Techs
   Usage statistics of PHP version 8PHP 8 minor version shares
7. W3Techs
   Usage statistics of WordPress39.6% of all websites
8. Wiz Research
   PHP2Shell: AI uncovers critical RCE vulnerabilitiesDiscovery timeline, AI role, affected versions
9. Qualys Threat Research Unit
   PHP2Shell: Find, Mitigate, and Patch NowInstall counts, EOL share, patch rate
10. watchTowr
    PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619Leak timeline, in-the-wild attempts, KEV status
11. CybelAngel
    2.24M internet-facing PHP hosts, 59% on versions with no fix (Mallory/Shodan data)Host counts by branch and country
12. Help Net Security
    PHP2Shell PHP vulnerabilities patchedAmazon pre-disclosure attempt, vendor exposure
13. TechTarget
    PHP2Shell: 22M exposed servers at risk as emergency patches releasedUnit 42 22.6M figure; OpenAI statement
14. Dark Reading / Decrypt / ZDFheute
    Coverage of discovery credit, government takedowns and BSI warningAlso decrypt.co/381567 and zdfheute.de BSI report
15. GCVE (CIRCL) / Tenable
    CVE-2024-4577 and CVE-2012-1823 records; CVE-2024-4577 analysisCVSS and KEV dates for past PHP bugs; CVE-2019-11043 via cvefeed.io