PHP2Shell is a critical vulnerability in PHP concerning memory safety that affects versions from 5.4 to 8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. The vulnerabilities were discovered with the help of AI in August 2026 and their existence was publicly announced on 20 October 2026. PHP is a popular programming language on which many website and web application codebases are built. These vulnerabilities are estimated to affect nearly 70% of websites. However, despite the corrective patches having been released on October 21, 2026, the vulnerability has been and continues to be widely exploited to conduct attacks of all kinds and for all purposes. PHP developers have released the patched versions of PHP 8.2, 8.3, 8.4 and 8.5 (8.2.35, 8.3.36, 8.4.27 and 8.5.12). Source code patches were released for versions 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life. The wisest choice is to promptly update all systems using PHP with the updated and patched versions. Maintaining legacy systems with outdated and un-patched PHP completely exposes you to losing control of your systems, with all the resulting consequences.
The vulnerability has also been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog.
See more details on: