PHP2Shell: what website and web application operators need to do now

On 21 October 2026, the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) issued a warning at level 3 of 4. Two vulnerabilities in the PHP programming language allow attackers to execute malicious code on web servers remotely. No user account is required, and no one has to click anything. Security media have named the flaws "PHP2Shell", a nod to Log4Shell from 2021. If you run a website, an online shop or a web application, you should act today.

What happened?

The PHP project has disclosed two vulnerabilities, both rated 9.2 out of 10:

• CVE-2026-109618: If PHP hits its memory limit while handling a request, internal data can be left only partially initialised. An attacker can trigger this state on purpose and exploit it.
• CVE-2026-109619: Internal request data can outlive the memory it is stored in. The next request handled by the same process then works with stale data.

According to the BSI, there are unconfirmed reports of first attack attempts. The agency expects widespread exploitation shortly after the updates appear, because AI-assisted tools now make it very fast to analyse patches. Some operators have taken their servers offline as a precaution, which has already left a number of websites in Germany unreachable.

Who is affected?

In short: almost anyone running PHP on the internet. The PHP project lists every installation that handles web requests, explicitly naming PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to CERT-EU, all versions back to at least PHP 5 are vulnerable. The PHP team considers mod_php the highest risk, because the attack can succeed there before any application code runs.

PHP powers many systems you might not immediately think of:

• websites and content management systems such as WordPress, TYPO3, Joomla or Drupal
• online shops, for example those built on Magento
• collaboration platforms such as Nextcloud
• firewalls such as pfSense and OPNsense, and the web interfaces of appliances
• custom portals and line-of-business applications

Keep in mind: the flaws are in PHP itself, not in the application. Updating WordPress or Nextcloud alone does not close them.

Which versions are safe?

Updates have been available since the afternoon of 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For versions 7.4, 8.0 and 8.1, which no longer receive official updates, the PHP team has made an exception and published source code fixes. If you install PHP through a Linux distribution's package manager, you will usually receive backported packages with their own version numbers. In that case, check the distribution's security advisory, for example from Debian, Ubuntu or Red Hat. The distributions received the fixes in advance.

What to do now

1. Take inventory: Which internet-facing systems use PHP? Website, shop, intranet, customer portal, firewall, ticketing system. Systems run by external service providers count too.
2. Patch and verify: Update PHP, restart all PHP processes and confirm the version with php -v or via the package version.
3. Rebuild containers: If PHP runs in Docker containers, updating the host is not enough. The images must be rebuilt with a patched PHP.
4. Check with vendors and providers: Appliances and firewalls need new firmware. If you rent web space, ask your provider to confirm that the update has been applied.
5. Retire old versions: PHP versions before 8.2 no longer receive updates from the PHP project, and PHP 8.2 only until the end of the year. These systems should move to a supported version anyway.

If you cannot update today

In that case, the BSI recommends temporarily disconnecting the server from the internet. The PHP team does list settings that make known attack paths harder, such as session.upload_progress.enabled=0 and a low post_max_size. It stresses, however, that these measures do not make an installation safe. The same goes for web application firewall rules that vendors have started shipping: they block known patterns, not every variant. Only the update provides full protection.

Beyond this specific case, the BSI advises using mechanisms such as SELinux or AppArmor. They limit the damage if a vulnerability is ever exploited.

Why patch management belongs on the management agenda

PHP2Shell shows how little time there is today. The gap between a patch being released and the first attacks is often just a few hours. If you only schedule updates for the next maintenance window, you are too late. Good patch management therefore needs three things: an up-to-date view of which software runs where, someone who follows security warnings continuously, and the ability to roll out and test critical updates at short notice.

That is the core of our managed hosting. Updates, security patches and system hardening are standard with us, along with round-the-clock monitoring and daily backups. Our servers are located in the NTT data centre in Frankfurt am Main.

Conclusion

The two PHP flaws affect a large part of the internet, and the BSI expects attacks to follow quickly. Check today where PHP runs in your organisation and install the updates. Where that is not possible right away, temporarily disconnecting the server is the safer choice. Details are available in the BSI security advisory (in German) and in the PHP project's announcement.

All posts