PHP2Shell: what website owners must do right now

PHP2Shell: patch your PHP server now

[{"selector":"#anim-777e7ef1-0c0f-46da-af5a-747a1636204e [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(0%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":7000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-dbd4b0f5-d97c-43e1-8206-9dcd1226449f","keyframes":{"transform":["translate3d(-108%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":200,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-81b5b221-6788-4a55-9c9a-b4b9f4b4f1cd","keyframes":{"opacity":[0,1]},"delay":200,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1693c4dd-70b0-40e8-a325-b399ccb139dd","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":200,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-acc29ec3-1675-4e9c-8cb3-921629c0661b","keyframes":{"opacity":[0,1]},"delay":350,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-379b57ef-f497-4d6b-9bce-0da8546289c4","keyframes":{"transform":["translate3d(0px, 359.0279%, 0)","translate3d(0px, 0px, 0)"]},"delay":350,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4aafdb35-226b-48ac-907b-b82a8f8ddad4","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] SECURITY ALERT SECURITY ALERT Two critical flaws, one request to take over Photo: PiDatacenters / CC BY-SA 4.0 / Wikimedia Commons

Emergency PHP fixes on Oct. 21

[{"selector":"#anim-508c366e-c7e2-4865-8fae-126ec1f8e8ed","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ab8567a5-6fba-4a55-b900-4009f5cbb86b","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b04f43f1-ab7a-4b29-81d8-a5fb1085fc47","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-33860022-8ba1-4921-9553-413ab7522c78","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2f67625f-e6e5-4b60-9f2c-ab14567d8169","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-39d6625a-2cf3-4df7-86c1-97cefca7f5c0","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] WHAT HAPPENED WHAT HAPPENED PHP shipped patches for CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated critical.

No login needed

[{"selector":"#anim-1248e9b6-dd6a-45af-960f-27bbb2330049","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a12b1832-4faf-4101-b38c-afe2b773cf08","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a92df96f-2487-4738-9740-b4478f19fdcd","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-59366081-9e84-41dd-aba8-a20931db948a","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f70c14d2-0395-4ced-8df8-fce1e275e2a2","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0092ee98-ed60-43a1-b6ec-113a7139cbe6","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] WHY IT IS BAD WHY IT IS BAD A single crafted request can run code on the server before any of your own app code, plugins or login page even load.

Any PHP web server

[{"selector":"#anim-c4d3f35a-e78c-4a9e-b893-c15e6dbe4c6f","keyframes":{"opacity":[0,1]},"delay":0,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-46a12be1-3c83-4299-ae52-12147b3127b1","keyframes":{"transform":["translate3d(-107.05882%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":150,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-45c85aa8-afab-43db-9ebf-5ba7bc31915c","keyframes":{"opacity":[0,1]},"delay":150,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-cba4c7c2-6b1d-4d7d-95be-ef355885ae40","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":150,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-01a37bd1-8408-44a9-9cca-35c3613fa37b","keyframes":{"opacity":[0,1]},"delay":300,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2b04ba77-69eb-4b01-acdd-d3fcdda2e5ad","keyframes":{"transform":["translate3d(0px, 386.28465%, 0)","translate3d(0px, 0px, 0)"]},"delay":300,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-334addd6-1edf-4845-83c9-c224cec9598f","keyframes":{"opacity":[0,1]},"delay":650,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] WHO IS EXPOSED WHO IS EXPOSED PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is at the highest risk. Photo: Derrick Coetzee / CC0

8.5.12, 8.4.27, 8.3.36, 8.2.35

[{"selector":"#anim-1144a929-667b-4c50-8828-6b191fcb252c","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ca78eaaf-de76-4bd3-b963-fb7c53d195b7","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4d609655-a67d-451e-87ce-644de399f1ec","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-fe5b2077-1cdb-4783-abfd-e733d320fbf8","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5b6b70f1-ef8a-43e1-a146-d0b53574bf5f","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5d891187-438a-4ef5-8a34-406895d16fa1","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] FIXED VERSIONS FIXED VERSIONS Anything older in those branches is affected. PHP 8.1 and earlier are end of life: upgrade or use a vendor backport.

Check Tools, Site Health, Info

[{"selector":"#anim-488b543c-1a77-4746-b148-59978b8ead64","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4e1a04b5-9913-4a35-8901-1ae4537c6b5c","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b8dcd3a6-5927-446d-b09f-8e9df586d982","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-97fa38ec-1218-4c9b-acc8-db22943a14b3","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3ed07114-f5ea-4134-8db1-10372ec40779","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5f011446-737f-47ea-9ab4-4dee73c79132","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] WORDPRESS USERS WORDPRESS USERS Open the Server section and read your exact PHP version. Compare it with the fixed versions.

One yes-or-no question

[{"selector":"#anim-d118cd0a-710c-4160-9ad7-eac2d2bb9013","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-11b1cd0c-fc03-447a-8fd8-3a9c92a43bea","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-46a241be-ba2d-46b7-9e34-0ad521484cc7","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-944eb5cb-ee2f-4b3f-8afc-b2a6dbf3ffc3","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-95ff91df-a1db-41a3-b1b6-7bce210927f9","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4b815b32-d27a-4b61-814c-2a80d6c80edb","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] ASK YOUR HOST ASK YOUR HOST "Have you deployed the PHP2Shell fixes on my server?" Do not accept a vague answer.

A stopgap, not a fix

[{"selector":"#anim-a7f6204c-2a6f-40ac-91d9-e55d1e1a175b","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-60a4fa6e-5af3-42b6-8d06-20b9d58c749b","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2fed57a4-50a0-4631-8267-229f22d03717","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-c8badc3a-53bb-47f4-b6e3-6587699fc779","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5087a5f6-f304-483a-a21c-b5319d5d14df","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8a5e2158-769a-47a0-b8ef-01879749b6ae","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] CANNOT PATCH TODAY? CANNOT PATCH TODAY? session.upload_progress.enabled=0 plus a restart of every PHP worker blocks one known attack path. The UK NCSC says go offline if you cannot fix it.

Turn on your CDN firewall

[{"selector":"#anim-c6b24377-0e8e-41d6-b118-43c14e46c4c3","keyframes":{"opacity":[0,1]},"delay":0,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c9f9d701-6224-47b7-b4c3-0326c72748cb","keyframes":{"transform":["translate3d(-107.05882%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":150,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d5222075-b006-46ea-bf55-cb40595c6a40","keyframes":{"opacity":[0,1]},"delay":150,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8554f1fd-bae2-406f-bb47-c4cedd111e7b","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":150,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-2095b37f-8bee-4f41-9d94-6e01251a994e","keyframes":{"opacity":[0,1]},"delay":300,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-79f9fad2-54e2-4998-85df-8a907368addc","keyframes":{"transform":["translate3d(0px, 386.28465%, 0)","translate3d(0px, 0px, 0)"]},"delay":300,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1d297bd7-83b5-4bf3-b757-99cd42699314","keyframes":{"opacity":[0,1]},"delay":650,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] EXTRA LAYER EXTRA LAYER Cloudflare says it has deployed initial rules for known exploit paths on all plans, including free. Photo: Carl Lender / CC BY 2.0

Look for signs of a break-in

[{"selector":"#anim-b739cb97-617e-4396-954d-12bb9804a953","keyframes":{"transform":["translate3d(-112.5%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-09c25544-880e-4afa-951e-9400968567a2","keyframes":{"opacity":[0,1]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b538f2a7-0897-42a0-8713-c39b35a7b785","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":250,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-9e298975-a523-4080-b5cb-e99eaecb78f4","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-31719157-5074-4105-a1ab-3cfe0d94be41","keyframes":{"transform":["translate3d(0px, 477.47485%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-72a5dff0-0f9b-41b4-855f-a11fde33f4b9","keyframes":{"opacity":[0,1]},"delay":800,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] AFTER PATCHING AFTER PATCHING New admin users you did not create, strange files in uploads, or spam pages showing up in Google.

The complete PHP2Shell checklist

[{"selector":"#anim-ae800428-3056-4350-bb04-3cf2929e4cc7","keyframes":{"opacity":[1,1]},"delay":200,"duration":400,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-c352a3b6-6b33-4a40-a9e4-82d0b03286db","keyframes":{"transform":["scale(3)","scale(1)"]},"delay":200,"duration":400,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-b1cacc53-ef3a-4f25-ab76-6d4b0fd52f1c","keyframes":{"opacity":[0,1]},"delay":300,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2b74105d-4b19-40f0-bd66-136d43f2c320","keyframes":{"transform":["translate3d(0px, 505.22222%, 0)","translate3d(0px, 0px, 0)"]},"delay":300,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-af20a6b8-d2fd-417b-a3ac-044bf69e6e60","keyframes":{"opacity":[0,1]},"delay":700,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-47d5d478-d458-454a-9c4b-d2ac754c423a","keyframes":{"opacity":[0,1]},"delay":1000,"duration":500,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-843f44a1-a185-4115-8260-f6dc3e2e102b","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":1000,"duration":500,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-bce3aad3-135a-4759-8911-dfbcb690e4d1","keyframes":{"opacity":[0,1]},"delay":1000,"duration":500,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-edc51fee-1352-4944-b7cd-ff1df3339708","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":1000,"duration":500,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] FULL GUIDE FULL GUIDE Fixed versions, who is at risk, and step-by-step help for WordPress and small business sites. Read the full guide nexgenheadlines.com Photos: Wikimedia Commons (credits on each page) Read the full guide