No, the Internet isn’t dying because of “one of the biggest vulnerabilities of 2026,” but here’s what you need to know.
follow us
Add us as a preferred source on Google
You’ve probably heard about PHP2Shell and how this newly emerged security issue is affecting a lot of websites, as well as warnings about how website owners should urgently apply patches to fix this issue.
It sounds like a big deal (and it is), so you probably have questions. Perhaps to start: what exactly is PHP2Shell and what does it affect? And what does it mean for you as a web browser user today? Is it not safe to visit some websites now?
This article aims to provide answers to common questions about PHP2Shell and explain all the key points you need to know about this vulnerability (well, it’s actually two vulnerabilities to be precise).
What is PHP2Shell?
PHP2Shell is the name given to a security flaw in the PHP programming language used by many websites and web applications around the world. In fact, PHP is used by almost 70% of websites like Wikipedia estimatesand is used in companies like WordPress, Drupal, Joomla, and other common systems that power websites, which is why the potential impact is so widespread.
In practical terms, attackers could execute malicious code on affected systems, including deploying web shells, thereby gaining control over vulnerable servers.
Sergey Lozhkin, Head of the APAC and META Research Center at Kaspersky
It consists of two independent memory-related vulnerabilities named CVE-2026-109618 and CVE-2026-109619. These flaws in the way PHP works could be exploited by a malicious attacker to compromise a site that uses PHP (which is most of the web, as noted), and this could potentially lead to the ability to execute code remotely.
This is a serious incident and these vulnerabilities have a severity rating of 9.2 out of 10.
What happens if an attacker manages to exploit a website using these vulnerabilities?
Sergey Lozhkin, head of the Research Center for APAC and META at Kaspersky GReAT, explained to TechRadar: “The potential impact is considerable: if successfully exploited, this vulnerability could allow remote code execution, one of the most serious forms of cyber compromise. In practical terms, attackers could execute malicious code on affected systems, including deploying web shells, thereby gaining control over vulnerable servers.”
In other words, the attacker could execute their own code and alter the content of a website for nefarious purposes (stealing data, for example), or redirect it to their own malicious site for phishing purposes (or even install malware directly).
Has PHP2Shell already been exploited?
PHP2Shell has been a more complicated client than expected because these vulnerabilities were revealed before the official announcement of the security issue was made. As we reported yesterday, someone leaked the details of these defects on the Hacker News forum before the embargo announcement occurred, leaving security experts scrambling to deploy defenses faster than they anticipated.
This meant that there were early attempts to exploit PHP2Shell, and in fact one of them dates back to before the flaw was leaked (let alone announced). According Amazon Threat IntelligenceAn attempt at exploitation was made as early as October 17, although “it is still unclear how the actor acquired the exploitation information prior to disclosure.”
As Malwarebytes points outDane Knecht, Cloudflare’s chief technology officer, reported that “early attacks” were also emerging, before the PHP team deployed patches to fix the security holes.
Amazon Threat Intelligence warns that: “PHP2Shell is now being widely exploited in the wild.”
So is this fixed now? Am I safe from the exploit?
In fact, patches have been implemented to seal these exploits. The PHP team yesterday released emergency security updates for PHP 8.5, 8.4, 8.3 and 8.2; the relevant fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Of course, having the patch ready is only the first step: the owners of the affected websites must apply it. They may need to install the update themselves or contact their hosting provider to make sure they have done so.
Obviously, given the urgency of the situation, this patching work should have already been done and, in theory, you should be safe on any given website. However, the caveat here is that there is no absolute guarantee and you should keep this in mind.
It’s worth noting that in terms of taking action, you don’t need to do anything yourself as a web surfer. These are not patches for web browsers; This is something that website owners need to address. (Although if you run a website using, say, WordPress, you should check with your hosting provider that PHP has been updated to the fixed versions mentioned above.)
In terms of practical realities, what should I keep in mind when browsing the web today?
For starters, you may find websites that are down for maintenance because they are busy applying the mentioned patch to fix PHP2Shell vulnerabilities. This is a potential annoyance, but short-term, and obviously a good thing (these patches need to be installed). However, at this point, it is likely that the major websites affected and using PHP have already done this work (given the urgency).
Otherwise, be especially careful about where you browse for the rest of this week, although you should always exercise caution and keep basic internet safety principles in mind as a matter of course, and keep an eye out for anything that looks suspicious. Be especially careful if you are suddenly redirected to another website or if something obviously suspicious happens, such as a download that starts out of nowhere. In such a case, please close the website (and browser) and do not return, then turn on your antivirus and run a scan.
If you can, it’s also wise to stay away from potentially less-maintained corners of the web, as a hidden danger is sites still running versions of PHP that aren’t officially supported (i.e. 8.1 or earlier). Due to this lack of support, these will not receive relevant security updates until the PHP version is updated to one that is compatible. Those running PHP 8.1 (or earlier) and unable to arrange such an update are in some cases advised to take their website offline for the time being (or at least use mitigations as a temporary solutionaccording to a publication by the NCSC in the United Kingdom).
Is AI to blame for this?
No, but if you’ve heard AI mentioned in relation to PHP2Shell, it’s because these days AI is making life easier for potential malicious actors when they learn about new exploits like this.
Be especially careful if you are suddenly redirected to another website or if something obviously suspicious happens, such as a download that starts out of nowhere.
Amazon Threat Intelligence explains: “In the past, most of the exploitation we see occurred after a public proof of concept was released. A small number of capable actors created exploits, and everyone else waited for them. That dependence is weakening. AI-assisted analysis makes it cheaper to turn a patch or advisory into a working exploit. As a result, more actors can act within hours or even minutes once the technical details of a vulnerability are revealed.”
The flip side is that AI is also being used to defend against existing bad actors, but concerns remain that in the long term it is likely to cause more harm than good in terms of accelerating the way emerging vulnerabilities are capitalized on.
Post Comment