php2shell: critical PHP flaws prompt European shutdowns. What now?

Quick guide: how to fix php2shell

What happened

On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as php2shell. Both are rated critical, and neither needs a login to exploit. The release came a day earlier than planned after details leaked publicly, and several European governments took websites offline as a precaution.

The US Cybersecurity and Infrastructure Security Agency (CISA) summed up the scope:

"These vulnerabilities, known as 'php2shell,' allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests."

Are you affected?

You are affected if any system you run, or that someone runs for you, serves web requests through PHP and is not yet on a fixed version or a vendor-patched package. That covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws sit in PHP itself, so WordPress, Drupal, Joomla, Magento and custom code are all exposed.

CISA's alert warns that "PHP is often a component of other software and prevalence may not be directly observable." So check four places:

• Your own servers. Look up the installed PHP package version with your package manager, not only the command-line version, because the web server can run a different PHP build from the one your shell finds.
• Containers. Rebuild on a patched base image and redeploy. Updating the host leaves PHP inside the image untouched.
• Vendor products and appliances. Commercial and open-source products often bundle their own PHP runtime. The Dutch National Cyber Security Centre (NCSC) keeps a public list of third-party software with a PHP dependency.
• Hosted and agency-run sites. Campaign microsites and old subdomains often run PHP on shared hosting, the same forgotten assets that routine reviews skip. Ask the hosting provider or agency what they patched, to which build, and when.

Fixed versions and how to verify the patch

A reported version does not establish patch status. Linux distributions often fix PHP without changing its version number. Ubuntu 22.04, for example, fixed PHP 8.1 in package 8.1.2-1ubuntu2.28, so a patched server still reports 8.1.2. A server that hides its version banner reports nothing useful either way.

To confirm a fix, check the host itself. Compare the installed package or vendor build against your vendor's advisory, and look at the PHP version the running workers use after a restart. Builds from source need the fixed release or PHP's backport.

Response checklist

The patch is out, so anything where you control the PHP version gets patched now. Where you can't control it, because it's baked into an appliance for example, watch for the vendor's update and apply it as soon as it's available. In the meantime, if something public-facing can't be patched right away, take it offline.

1. Inventory PHP, internet-facing first. List every system from the checks above, starting from your external attack surface. Attackers can reach exposed systems directly, so patch those first.
2. Patch. Update to the fixed release for your branch, or install your distribution's patched package. CERT-EU, the cybersecurity service for the EU institutions, warned that the volunteer remirepo repository would not have same-day updates, so check before relying on it. Where PHP is built into an appliance or vendor product, apply the vendor's update as soon as it ships.
3. Restart and verify. Restart PHP-FPM workers or the web server so the fixed code loads, then confirm the running version on each host, not just the installed one.
4. Isolate or take offline every exposed system you cannot patch now. That includes anything on PHP 8.1 or older without a vendor fix, and any appliance still waiting for its vendor's update. CISA advises taking such systems offline, and a joint statement from EU bodies including the European Commission, ENISA and CERT-EU recommends cutting them off from public networks. Bring them back once the fix is applied and verified.
5. Use stopgaps only until you patch. A web application firewall may provide some protection, and PHP lists interim configuration changes, such as disabling session upload progress and capping POST request size, that close some attack paths. In PHP's own words, "only an update is a complete solution."
6. Record when each system is done. For every affected system, including those your hosting providers and vendors run, record the hostname, the package or vendor build now running, the advisory it addresses, when workers restarted, when the fix was checked and who checked it. A provider's plain "yes, we patched" does not show any of that.
7. Check for compromise. Patching does not undo an intrusion that happened before the fix, so review every host that was exposed while unpatched. The exploitation section below lists what to look for.
8. Check whether you must report. If you find a compromise, reporting deadlines may already be running. Keep the remediation record from step 6 alongside your incident timeline and impact assessment.

NIS2. Organisations in scope must send an early warning to their CSIRT (the national computer security incident response team) or competent authority (the national regulator that supervises them) within 24 hours of becoming aware of a significant incident. A significant incident is one that causes or could cause severe operational disruption or financial loss for the organisation, or considerable material or non-material damage to others. Our guide to NIS2 compliance covers the full reporting timeline.

GDPR. If the compromise is a personal data breach, which covers data lost, altered or made unavailable as well as accessed, notify your data protection authority within 72 hours of becoming aware of it where feasible, unless the breach is unlikely to put individuals at risk.

Is php2shell being exploited?

Reports differ on whether attacks have started. CISA said it had not observed exploitation when it published its alert on 21 October. The same day, Reuters reported technology firms warning that some attackers were already exploiting the flaws, and CERT-EU noted that initial proofs of concept had begun to circulate.

A published patch also shows attackers where to look. Lukasz Olejnik, a visiting senior research fellow at King's College London, told Reuters that "with AI exploitation may happen instantly." Do not wait for confirmed exploitation or a listing in CISA's Known Exploited Vulnerabilities (KEV) catalog before acting.

On any host that was internet-facing while unpatched, look for the signs CISA flags, such as "PHP worker processes launching shells or downloading tools." If you find any, step 8 of the checklist sets out who you may have to notify, and how fast.

What does the php2shell vulnerability do?

The php2shell vulnerability can let an attacker run their own code on a PHP web server without logging in, and from there open a shell, meaning command-line control of the server. The name covers two flaws in how the PHP core manages memory between web requests. Each scores 9.2 on CVSS v4.0.

CVE-2026-109618 corrupts memory when out-of-memory handling interrupts PHP while request data is only partly initialised. CVE-2026-109619 lets request state survive after its memory is freed, so a later request on the same worker can use it.

The PHP security advisory describes a demonstrated exploit against Apache with mod_php, which PHP rates as the highest-risk setup. In it, one unauthenticated request triggers the attack before any application code runs. That is why a login page in your CMS or application does not stop it, and why the fix has to happen in PHP itself.

According to Reuters, research firms found the flaws with help from AI models, a kind of discovery that also contributes to the rising CVE volume we covered when CISA retired its weekly Vulnerability Bulletin.

Why did European websites go offline?

Public bodies in the Netherlands, Denmark, Finland and France took websites offline on 21 October as a precaution against php2shell. Reuters reported that the Dutch NCSC pulled its own website, and organisations including the Port of Rotterdam and the government portal Overheid.nl followed.

In Denmark, the municipal IT company Kombit shut down several services, including the national school communication platform. Finland's state IT provider Valtori took government public network services offline, and France's Interior Ministry put its websites into preventive maintenance.

What can an external scan tell you about php2shell?

An external scan gives you discovery evidence, meaning the hosts you expose, the technologies it can detect and any PHP version a server discloses. A scan cannot see whether a distribution backport is installed or whether workers have restarted. That remediation evidence comes from the host itself, as the verification steps above describe.

But discovery is still the first job. According to internet scan data cited by Reuters, about 1.5 million of 2.6 million hosts report running a PHP version with no fix. Because scans read reported versions, some of those hosts will be distribution builds that are already patched. All of them need checking on the server.

Read-only access · Working scan data deleted after each scan · EU-hosted