On 17 October 2026, four days before PHP published a word about it, a decoy server run by Amazon's security team was already being attacked with a working exploit, according to Help Net Security. By the 21st, the UK's Office for Budget Responsibility had taken its website down.
The headlines call it a PHP data leak. It isn't one, at least not yet. It is a door that was found unlocked, and what matters is whether anyone walked through yours. This post explains what the PHP2Shell vulnerability is, what it could expose, and what to do about it. All of it is as at 29 October 2026.
What happened in the PHP security incident?
PHP is the programming language behind a huge share of the web. W3Techs puts it at 69.2% of the websites whose server language it can identify. WordPress and Magento both run on it.
On 20 October, details of two serious flaws leaked before the planned announcement. PHP then brought its release forward, and on 21 October it published an advisory and fixed versions. The security researchers at watchTowr say they saw attacks in the wild the same day. England's NHS issued its own cyber alert (reference CC-4875) on 21 October.
Not every outage was an attack. Oxford City Council's website went offline briefly, and the council said it was a precaution and not a cyber incident. A government minister said he had seen no sign of a breach of Budget security. Many organisations simply switched sites off while they patched.
What is the PHP2Shell vulnerability?
"PHP2Shell" is the nickname for two flaws, CVE-2026-109618 and CVE-2026-109619. Each scores 9.2 out of 10 for severity.
Both are what security people call remote code execution. In plain terms: someone on the internet can make your server run their commands, as if they were sitting at its keyboard. They do not need a password.
The two bugs get there differently:
- CVE-2026-109618. PHP runs out of memory halfway through setting up a visitor's request. It is left with half-built data, and the clean-up step trusts that data anyway.
- CVE-2026-109619. Some information outlives the memory it points to. The next visitor handled by the same PHP "worker" (one of the small programs that serve your pages) can end up acting on that leftover.
One detail should worry anyone who relies on their site's login page for protection. On servers running Apache's mod_php, PHP says an attack can succeed before any of your own code runs. Your site's passwords never get a say.
How can PHP vulnerabilities lead to data leaks?
Think of it as four steps, and a leak needs all of them.
Once an attacker can run commands, they can read whatever your web server can read. On a typical site that means configuration files holding database passwords, uploaded documents, and, through the database, customer records and orders. PHP also lists memory disclosure as a confirmed effect of the second bug, meaning scraps of what the server was holding in memory can leak.
That is the risk. Here is the limit of what we know. Researchers have reported taking over decoy servers running PHP 8.4.26. The sources we checked report no confirmed theft of customer data from a named business. But that is not proof nobody was hit. Most companies don't publish their logs, and a quiet break-in stays quiet.
There is a second, plainer cost: downtime. Pulling a site offline to patch it is a business interruption even when no data moves.
Which websites and businesses are at risk?
Any site where PHP answers web requests. That covers PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP, so in practice most PHP setups:
- Company websites and blogs on WordPress or another PHP-based CMS
- Online shops on Magento, WooCommerce or custom code
- SaaS products and customer portals written in PHP
- Booking, admissions and patient portals, which often hold the most sensitive records
The flaw is in PHP itself, not in WordPress or your plugins. Updating WordPress does not fix it. What matters is the PHP version on the server, and that table looks like this:
| If your server runs | What to do |
|---|---|
| PHP 8.5, 8.4, 8.3 or 8.2 | Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later) |
| PHP 8.1, 8.0 or 7.4 | PHP's project has no official release. Ask your host or Linux vendor for a patched package |
| PHP 7.3 or older, including PHP 5 | No fix exists. Move to a supported version |
If you use a managed host, it may already have patched. Linux distributions and long-term-support vendors got their fixes before the public release. Don't assume it, though. Ask.
How can businesses protect their websites from PHP security threats?
Do these in order.
- Find out which PHP version you run. Your hosting panel usually shows it. If not, ask whoever built the site. This is the step most people get stuck on.
- Update, then restart. Installing a patched package does not fix PHP processes that are already running, so PHP says to restart every worker afterwards.
- If you can't update today, don't rely on settings. PHP lists a few settings that cut off some attack paths, and states plainly that they do not make an installation safe. The UK's NCSC goes further and advises taking a system offline if it cannot be fixed straight away. Cloudflare's firewall rules help too, but only for traffic that goes through Cloudflare.
- Check your logs from 17 October, not 21 October. Amazon's first sighting of the exploit was four days before disclosure. Look for PHP files that appeared in upload folders, new admin users nobody created, and requests that hammer one page repeatedly. If you see signs of probing, save a copy of the evidence before restarting.
- Keep a clean backup and tighten access. A backup stored somewhere your web server cannot write to is the one you can trust after an incident. If you suspect a break-in, change database passwords and API keys, because those sit in files the attacker could have read.
- Get an independent check if the site holds customer data. A scan by someone outside your team costs far less than finding out in a customer's complaint.
Why secure software development matters
Here is the awkward part. Nobody's own code caused PHP2Shell. The bug sat in PHP, so careful developers were exposed just like careless ones.
What separated the sites that shrugged this off from the ones that scrambled was everything around the code. Did anyone know which PHP version each server ran? Could they test an update on a copy first, then roll it out in an hour? Was the web server limited to the files it needs, so a hijacked server couldn't read everything? Were passwords kept out of the public folder?
That is a habit, not a one-off project, and it is where maintenance of an app usually gets neglected. The same goes for getting an app to production grade in the first place.
A fair warning if you are choosing a partner. No software company can promise you zero vulnerabilities, and you should doubt anyone who does. A better test is a simple question: "If a PHP flaw dropped tonight, how fast could you tell me which of my servers are affected?" Our guide to choosing a software development company in India covers more questions like it.
What to do this week
Look at the table above, find your row, and ask your host or developer for the exact PHP version and the date it was last restarted. If the answer is a shrug, that tells you more than the vulnerability does.
PHP2Shell will be patched and forgotten within months. The next one won't announce itself either. Looking to build or secure your business applications? Explore custom software development solutions from Vidyayatan Technologies.