PHP2Shell: the two critical PHP flaws that pushed governments offline

PHP2Shell is a nickname for two vulnerabilities in the PHP programming language itself, not in any single website or app. They are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP's own security team rated both 9.2 out of 10 on the CVSS v4.0 scale, its 'critical' tier, according to the PHP project's official 2026 archive page.

What the two flaws actually do

According to the PHP project's own advisory, CVE-2026-109618 is triggered when PHP runs out of memory while it is handling a web request. The out-of-memory error can interrupt PHP before internal request data is fully set up, and the cleanup process that follows may then treat that incomplete data as valid, which can lead to memory corruption and remote code execution.

CVE-2026-109619 is described by PHP as a 'stale global state' bug: data tied to one visitor's request can remain in a server's memory after it should have been cleared, and the next visitor's request handled by the same worker process may end up acting on those leftovers. Security firm watchTowr, which runs a global network of monitoring systems, said both bugs allow an attacker to run code with no login required, before a website's own code even starts executing.

Dutch security firm Sansec added further technical detail, saying one of the paths to exploitation runs through PHP's session 'upload progress' feature and can expose data such as passwords, API keys and encryption keys that happened to be sitting in a server's memory from other, unrelated requests.

Why so many websites were exposed

The bugs sit inside the PHP engine, so any website or app built with PHP is potentially exposed, regardless of which content system runs on top of it. That includes widely used platforms such as WordPress, Drupal, Joomla, Magento and Nextcloud, according to Sansec. PHP remains one of the most widely used server-side programming languages on the web, which is one reason the flaws were treated as posing a broad, large-scale risk.

Security researchers at Wiz identified the flaws, and Help Net Security reported that the researchers said advances in frontier AI tools had significantly lowered the technical barrier to turning a long-known, hard-to-exploit memory-handling issue into a working exploit.

Why governments pulled sites offline

Technical details of the flaws leaked before PHP's official patch was ready, cutting the usual head start defenders get before a fix becomes public. Security blog Safeguard reported that on 21 October 2026, the Netherlands took down services including its national cyber security centre's own site, Overheid.nl, the House of Representatives website and several hospital and political-party sites as a precaution. Finland's state IT provider Valtori took government network services offline as a precautionary step, and Denmark's municipal IT company Kombit shut down several services including a national school communication platform. France's Interior Ministry temporarily took down prefecture and local administrative sites, saying it was waiting for the PHP fix to be applied. Germany's federal IT provider ITZBund and Belgium's Foreign Ministry also took sites offline, though Safeguard reported they gave different reasons: ITZBund said it knew of no security incidents, while Belgium's Foreign Ministry cited reports of attacks.

watchTowr said its honeypot network, Attacker Eye, recorded real-world exploitation attempts starting 21 October 2026, a day after the leak and the same day PHP published its fix.

The two flaws compared

How to protect your site and your data

1. If you run a website on PHP: update to a fixed version — PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — and restart all PHP worker processes afterward, as PHP's advisory and runZero both stress that updating is the only complete fix.
2. If you are still on PHP 7.4, 8.0 or 8.1, which no longer get official updates, get a backported security patch from your Linux distribution or hosting provider, since PHP's own project has stopped maintaining those branches, according to the PHP archive page.
3. Until you can patch, runZero recommends interim steps at the server or proxy level: cap memory limits so applications cannot override them, enforce low request-size and multipart-upload limits, and disable the session 'upload progress' feature.
4. Check your web server access logs for unusual multipart/form-data POST requests, which Sansec says are common to known exploitation attempts, and watch for unexpected PHP memory spikes or fatal errors.
5. As an everyday internet user, you cannot patch servers you don't control, but you can watch for breach notifications from services you use, use a unique password for each account, and turn on two-factor authentication so a leaked password alone is not enough to access your accounts.

What is still unclear

As of the reporting reviewed, there was disagreement among experts over how widespread active exploitation already was at the time several governments decided to take sites offline; Safeguard reported that the Dutch government said it had no signs of active exploitation when it acted, while watchTowr separately confirmed real attack attempts against its honeypots the next day.