PHP2Shell: the critical vulnerability of October 2026, explained for everyone

On 21 October 2026, the PHP security team released emergency updates for two critical vulnerabilities, known together as “PHP2Shell”. Because PHP powers the largest share of the world’s websites, the news put server administrators everywhere on high alert.

What was discovered

The two issues, registered as CVE-2026-109618 and CVE-2026-109619, are “use after free” errors in the PHP core. When exploited, they allowed an attacker to run code on the server without any account and without any password. Shortly after publication, a proof-of-concept exploit also appeared and was publicly available — in other words, the recipe was out in the open, and any PHP server exposed to the internet became a possible target.

Why it was so serious

An attacker who can run code on the server can do practically anything: read the database, steal customers’ personal data, change the pages, send spam from the company’s domain or install hidden back doors for later. On top of that, old PHP versions no longer receive official updates, so servers running them depend entirely on the hosting provider for fixes.

On 23 October, the PHP team also announced a third, related issue (CVE-2026-115560), which can be mitigated through a server configuration setting until it is fixed.

What had to be done

Just one thing, but quickly: apply the updates. Anyone who runs their own server had to do it themselves. Anyone with managed hosting depended on their provider’s response — and this is where the difference showed between hosting that is seriously maintained and hosting that is left to fend for itself.

How it went for AI Soft clients

The servers hosting our clients’ websites received the security fixes as soon as they were available, and the configuration was checked for the third vulnerability as well. Clients had nothing to do and nothing to install: security maintenance is included in AI Soft hosting.

The PHP2Shell episode shows once again that a website’s security is not a setting made once, but ongoing maintenance. If your company’s website is hosted somewhere, the right question is simple: who applies the security updates, and how quickly?