PHP2Shell: Critical PHP Flaws Force Emergency Updates
The U.S. agency CISA advises taking PHP servers offline if they cannot be patched immediately. A first attempted attack reportedly occurred four days before disclosure.
By Marcel
Automatically translated from German · may contain errors · Read the original
The PHP team released emergency updates on Wednesday, Oct. 21, to fix two critical security vulnerabilities in the PHP scripting language. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged operators to update their systems immediately or take them offline.
According to CISA, the flaws, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. That means attackers can run their own code on a server without logging in. The vulnerabilities have a CVSS score of 9.2 on a scale that goes up to 10.
The flaws are fixed in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone running PHP 8.1 or older, or unable to update immediately, should take their systems offline, according to CISA's recommendation. The U.K.'s National Cyber Security Centre (NCSC) gives the same advice for systems that cannot be patched right away.
Attack attempt before disclosure
According to Amazon Threat Intelligence, the security division of the U.S. company, there was already an attempt to exploit the flaws on Saturday, Oct. 17, four days before they were disclosed.
Networking equipment maker Cisco said in a security advisory about its own products that its security team was not aware of any malicious exploitation. There are no workarounds, it said.
According to the newspaper The New York Times, operators took many websites offline as a precaution. An unpatched server could reportedly be fully taken over.
Around 69 percent of websites run on PHP
The scale of the problem stems from how widely the language is used. According to data from the analytics service W3Techs dated Oct. 22, PHP is behind 69.3 percent of all websites whose server-side language can be identified. The PHP-based content management system WordPress alone accounts for roughly 40 percent of all websites worldwide, according to the data.
PHP runs on the server, where it generates HTML or other output that is sent to the browser. The source code itself stays on the server. Major users include Wikipedia with its MediaWiki software, the Drupal, Joomla and Magento systems, and the marketplace Etsy.
The language grew out of a private tool. Danish-Canadian programmer Rasmus Lerdorf wrote scripts in 1994/1995 to count visits to his homepage and process forms. In June 1995, he released the code as "Personal Home Page Tools." Today, PHP stands for "PHP: Hypertext Preprocessor."
PHP was never planned as a full-fledged programming language. Lerdorf later said he had simply kept adding the next practical step. Because PHP was easy to learn and ran on cheap web hosting, it became the standard for dynamic websites.
Many websites run old PHP versions
According to W3Techs, around 65 percent of PHP websites use version 8, 27 percent still use PHP 7 and just under 8 percent use PHP 5. Outdated installations running PHP 7 and older remain a security risk.
According to the PHP Foundation, PHP 8.5 and 8.4 are currently actively maintained, while PHP 8.3 and 8.2 only receive security updates. Older versions no longer receive official updates. Support for PHP 8.2 ends at the end of 2026, and for PHP 8.5 at the end of 2029. The next version, PHP 8.6, is planned for November.