Last updated: 2 November 2026

Latest update, 2 November: PHP2Shell is now being used to attack firewalls, not just websites. Palo Alto Networks has confirmed attacks on PAN-OS firewalls whose management page is open to the internet, and has released fixes. In some attacks it was combined with a Linux flaw called Fragnesia to take full control of the device. If you run Palo Alto firewalls, patch PAN-OS now and make sure the management interface isn't reachable from the internet.

PHP2Shell is the name for two linked flaws in PHP, CVE-2026-109618 and CVE-2026-109619. They could let an attacker run commands on a web server without logging in. CISA has confirmed both are being exploited, and the first successful attacks were reported on 24 October.

PHP released fixes on 21 October 2026: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier get no official fix. If you use PHP anywhere, update it now.

What is the PHP vulnerability?

PHP2Shell is two critical flaws in how PHP handles memory. Either one could let an attacker take control of a web server without a password, which could lead to data theft or a wider breach.

• Both are rated critical, with a CVSS v4.0 score of 9.2 out of 10.
• Every PHP website stays vulnerable until it's updated. Some setups are at higher risk than others, and your developer or host can tell you which applies to you.
• The NCSC issued an alert on 21 October 2026, the same day PHP released the fix.
• Products with PHP built in, such as firewalls and other network appliances, are affected too. They need a fix from the vendor rather than a standard PHP update.
  
  

Which PHP versions are affected and which are safe?

Any PHP version older than the fixed releases below is vulnerable.

Some hosts applied the fix early, so check with your provider before assuming you're exposed.

Windows: on 26 October PHP released updated Windows builds (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1). These fix a separate flaw, CVE-2026-111497, in a bundled compression library. The version numbers are the same; the "-1" on the end tells you it's the new build.

Known bug in 8.4.27 and 8.5.12: a bug in these two releases can crash some sites that use PHP's SimpleXML feature. A fix is being worked on but hasn't been released yet. If you hit it, talk to your developer. Don't roll back to an older version, as that leaves you open to PHP2Shell.

Is PHP2Shell being exploited?

Yes. Attackers have taken over test servers, and since 28 October they've also been confirmed attacking Palo Alto firewalls. No UK businesses have been named as victims so far. Here's where things stand as of 2 November: 

• 29 October: Palo Alto Networks confirmed attacks on PAN-OS firewalls whose management interface is open to the internet. It rates the issue critical and has released fixes for every affected version. It says about 0.02% of its customers were affected and has contacted them directly.
• 28 October: CISA added Fragnesia (CVE-2026-46300), a Linux flaw, to its Known Exploited Vulnerabilities list. Attackers combined it with PHP2Shell to plant hidden backdoors and get full control of the device. Security firm Dream reported 25 servers taken over this way in the US, Japan, Taiwan and South Korea.
• 26 October: CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities list. US federal agencies had until 29 October to fix them.
• 24 October: A researcher reported attackers taking over honeypot test servers running PHP 8.4.26 on Apache with mod_php.
• 22 October: UK ministers said 32 government services were fully offline and 4 partly offline as a precaution. Several councils did the same. No compromise of UK public sector systems has been confirmed.
• 21 October: watchTowr started seeing attackers use both flaws. Cloudflare reported “millions” of attack attempts in the first 24 hours after the fix.
• 17 October: Amazon saw attack attempts, four days before the flaws were made public.

Trail of Bits built a working attack against an unmodified MediaWiki site and says it works on unpatched PHP 8.2 to 8.5 [check source].

The good news: researchers at Tenable say attacks on ordinary websites usually have to be tailored to each server's setup, so they don't spread as easily as Log4Shell did. Network appliances are the exception. Every device runs the same software, so one working attack can hit them all. That's why firewalls have been targeted first.

Related flaw: CVE-2026-115560, announced on 23 October, is lower risk and only affects unusual setups. A temporary fix is available, and the full fix will come in PHP's next release.

Is my business affected?

You're affected if you run PHP older than the fixed versions anywhere, or use a product with PHP built in that hasn't been patched yet. PHP is everywhere: W3Techs estimates it runs about 70% of websites where the server-side language can be identified.

Places you might be exposed:

• Your company website, including WordPress sites
• Customer portals or booking systems
• Third-party applications you host
• Firewalls and network appliances. These have PHP built in, so a normal PHP update doesn't apply. You need the vendor's own fix. Palo Alto's PAN-OS firewalls and Panorama are confirmed affected and under attack. Cisco also has products listed as vulnerable.
• Other products with PHP built in, such as hosting control panels

Highest risk:

• Anything that can be reached from the internet, especially firewall and appliance management pages
• PHP 8.1 or older
• PHP run as an Apache module (mod_php), the setup used in the first confirmed attacks on web servers

How do I find out if we use PHP?

Start with anything that can be reached from the internet.

• Ask your developer or host which sites run PHP, which versions, and whether they were updated after 21 October.
• Check your asset lists or IT documentation.
• List your firewalls, VPNs and other network appliances, and check each vendor's advisory. If you use Palo Alto, check your PAN-OS version against Palo Alto's advisory (linked below).
• Ask your software suppliers whether their products use PHP and when fixes will arrive.
• Check the NCSC-NL list of software that depends on PHP. On 28 October it tracked 757 products: 218 vulnerable, 144 fixed and 354 still being checked. Its maintainers say it may not be complete.

The things people miss most often are old sites nobody manages any more, and systems everyone assumes the supplier is looking after.

What does the NCSC recommend?

The NCSC lists six actions, in order of priority:

1. Find where PHP runs, starting with systems that can be reached from the internet.
2. Update to a safe version, and keep an eye out for further updates.
3. If you can't update yet, apply PHP's temporary fixes. These reduce the risk but don't remove it.
4. If you can't do either quickly, consider taking the system offline.
5. If a system was exposed, check it for signs of compromise, such as hidden backdoors, before you update. An NCSC-assured Cyber Incident Response provider can help.
6. Watch for fixes from suppliers whose products have PHP built in, and apply them as they come out.
   • Palo Alto customers: update PAN-OS to a fixed version (at least 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 or 10.2.18-h13, depending on your branch). Limit management access to trusted internal IP addresses, and don't leave the management interface open to the internet.

After updating:

• Restart PHP or the web server. Installing the update on its own isn't enough.
• Keep session.upload_progress.enabled turned off until PHP's next routine release, unless your site needs it. The Dutch NCSC recommends this, and it also covers CVE-2026-115560.

Frequently asked questions

What is PHP2Shell? Two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on a server without logging in. PHP released fixes on 21 October 2026.

Is my website at risk? Yes, if it runs PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Deal with sites that can be reached from the internet first.

Which version should I update to? The latest version on your branch. PHP 8.2 support ends on 31 December 2026, so plan a move to 8.3 or later.

What if we're on PHP 7.4, 8.0 or 8.1? There's no official fix. Ask your host for a patched build, or upgrade.

Is PHP2Shell being exploited? Yes. CISA added both flaws to its Known Exploited Vulnerabilities list on 26 October. The first successful attacks were reported on 24 October, and since 28 October Palo Alto firewalls have been confirmed as targets.

Are firewalls affected by PHP2Shell? (new) Some are. Firewalls and other network appliances often have PHP built in. Palo Alto has confirmed attacks on PAN-OS firewalls and Panorama, and Cisco has products listed as vulnerable. Check your vendor's advisory, because a normal PHP update won't fix an appliance.

Is my Palo Alto firewall vulnerable? (new) It is if it runs an unpatched PAN-OS version, and the risk is highest if the management interface can be reached from the internet. Update to a fixed version (Palo Alto's advisory lists them for each branch) and limit management access to trusted internal IP addresses.

What is Fragnesia and how is it linked to PHP2Shell? (new) Fragnesia (CVE-2026-46300) is a flaw in the Linux kernel. Attackers have used PHP2Shell to get in, then Fragnesia to take full control. CISA added it to its Known Exploited Vulnerabilities list on 28 October. Make sure your Linux servers are on a patched kernel.

Why do some people say PHP2Shell exploits don't work? (new) Many of the attack scripts going round don't work, and attacks on ordinary websites usually have to be tailored to each server. That doesn't make you safe: working attacks exist, and appliances that all run the same software are much easier to hit. Patch anyway.

Are there known problems with the new PHP updates? (new) One. A bug in 8.4.27 and 8.5.12 can crash some sites that use SimpleXML. A fix is in progress. Don't roll back to an older version to avoid it.

Do I need to restart after updating? Yes. The fix doesn't take effect until PHP or the web server restarts.

How do I find out if we use PHP? Ask your developer, host and software suppliers, check your IT documentation, and list your network appliances.

Should I take my site offline? Only if you can't update or apply the temporary fixes quickly.

Why did government sites go offline? As a precaution while fixes were applied. No compromise has been confirmed.

What is CVE-2026-115560? A separate, lower-risk flaw announced on 23 October that only affects unusual setups. A temporary fix is available.

What is CVE-2026-111497? A flaw in the Brotli compression library in PHP's Windows builds, fixed on 26 October. It doesn't affect you if you don't run PHP on Windows.

Is WordPress affected? Yes, if the PHP version underneath it hasn't been patched. Ask your host.

Useful links

1. NCSC alert: Critical security issue affecting PHP
2. PHP news, releases and mitigation guidance
3. PHP security advisory, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)
4. PHP security advisory, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)
5. CISA alert adding the two PHP2Shell flaws to the KEV catalogue, 26 October
6. CISA alert adding Fragnesia (CVE-2026-46300) to the KEV catalogue, 28 October
7. Palo Alto Networks advisory: impact of the PHP flaws on Palo Alto products
8. NCSC-NL list of software that depends on PHP
9. NCSC vulnerability management guidance
10. Find an NCSC-assured Cyber Incident Response provider
11. NCSC Early Warning service (free for UK organisations)