What Is PHP2Shell? PHP Security Issues Explained Like You’re 5

Ever wondered what all the fuss about PHP2Shell is? And why did a patch land on 21 October 2026? Here’s PHP2Shell explained simply, using a restaurant kitchen to show what happened, why it matters, and how to keep your website safe.

Table of Contents:

• What Is PHP2Shell?
• Think of Your Website as a Restaurant
• Why the Bouncer Didn’t Stop It
• How It Got Fixed
• What to Ask First?
• If MPiFY Looks After Your Website

What Is PHP2Shell?

PHP2Shell is the nickname for two critical bugs (CVE-2026-109618 and CVE-2026-109619) in PHP, the programming language that runs roughly 70% of websites whose server-side language can be identified. Both score 9.2 on the CVSS severity scale. Think of it as a pair of serious mistakes that let strangers trick a website into following their instructions.

FYI, most websites rely on a little helper called PHP. Someone found a way to trick that helper into doing whatever a stranger tells it, and the developers have now taught it not to fall for the trick.

That’s it. The rest of this page explains why it happened and how to make sure your website’s helper has learnt its lesson.

Think of Your Website as a Restaurant

Every time someone visits your website, it’s like a customer placing an order. The order goes to the kitchen, where PHP reads the ticket, prepares the page and sends it back out.

A good kitchen clears each ticket off the counter before the next one arrives. PHP2Shell is what happens when it doesn’t.

When the kitchen gets busy, a cook might accidentally grab the next ticket while the previous one is still lying around. A clever troublemaker worked out how to slip their own ticket onto the counter at exactly that moment.

And this wasn’t an ordinary order for a pizza. It said, “Hand me the keys to the restaurant.”

The cook, thinking everything was perfectly normal, actually did it. Yikes.

With the keys, the troublemaker could do anything from changing the menu to reading the customer list. On a website, that could mean changing your pages or stealing your customers’ details. Suddenly, your digital storefront has become a very expensive security headache.

Why the Bouncer Didn’t Stop It

Because PHP2Shell targets the kitchen itself, before the bouncer even starts their shift.

Most websites have a bouncer: a security plugin or firewall that checks visitors at the door. So why didn’t it help? By the time anyone checks who walked in, the dodgy ticket may already be sitting on the counter.

That doesn’t mean firewalls are useless. They still play an important role in website security. Cloudflare, for example, activated protective rules nine hours before the flaw was publicly disclosed.

The problem is that a bouncer cannot fix a broken kitchen workflow. The proper solution is to update PHP so the vulnerability is closed at its source.

And the troublemakers moved fast. The first exploitation attempt was spotted on 17 October 2026, four days before the PHP developers publicly announced the problem and released the fix.

By the way, these bugs had been lurking around for 14 years. Imagine finding a dodgy kitchen procedure that everyone somehow missed for over a decade.

How It Got Fixed

On 21 October 2026, the people who build PHP gave every kitchen a new rule: always wipe the counter before reading the next ticket. That rule comes in the form of an emergency PHP update. Once your website has the fix, the vulnerable behaviour that made PHP2Shell possible is addressed.

The catch? Every kitchen has to install the new rule itself. PHP won’t pop round with a toolbox and fix everything automatically. Your hosting provider or web agency needs to handle the update.

What to Ask First?

1. Ask whoever looks after your website one question: “Has our PHP been updated since 21 October, and to which version?” A safe answer is PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a newer fixed release.
2. Check older PHP versions. If your provider says PHP 8.1 or older, the kitchen is running on very old equipment. Ask them to confirm that the vulnerability has been addressed and plan an upgrade.
3. Keep WordPress and its plugins up to date. Old plugins are like a back door left open, whatever the kitchen does. Updating PHP is essential, but it doesn’t magically fix every other security problem on your website.

That’s what grown-ups should do. No cybersecurity degree required.

If MPiFY Looks After Your Website

MPiFY made sure every website it hosts had the update on 22 October. We also searched for any sign a troublemaker got in early, and found none, so if we look after your site you don't need to do anything. That is the kind of job our web hosting and SiteCare service exists for, alongside web design, AI automation, and SEO/ AEO services. If you want the bigger picture on keeping a site healthy after launch, our guide to web design and development covers it.

Not one of ours, or not sure? Send us your website address and we’ll tell you in plain English whether your kitchen got the update. No charge, no sales pitch.

Ask MPiFY to check your website⁠

Want the grown-up version, with the technical details, vulnerability identifiers and fixed PHP versions? Read our full PHP2Shell guide here.

FAQ

What is PHP2Shell in simple terms?

PHP2Shell is a pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers trick a website into running their commands.

Which PHP versions fix PHP2Shell?

The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or newer releases.

Can a firewall or security plugin stop PHP2Shell?

Not on its own, because PHP2Shell targets PHP internally, so the proper fix is to update PHP.

Is my PHP website safe from PHP2Shell?

Your website is protected against these flaws once it runs a fixed PHP version or has an appropriate vendor-applied patch.

Do I need to update WordPress plugins after PHP2Shell?

Yes, you should keep WordPress and its plugins updated because outdated plugins can create separate security risks.

Will PHP update itself?

No, your hosting provider or web agency must install the update unless your hosting setup handles it for you.

Key Takeaways

• PHP runs roughly 70% of websites with an identifiable server-side language.
• Both PHP2Shell vulnerabilities score 9.2 on the CVSS severity scale.
• The first exploitation attempt was recorded on 17 October 2026, four days before disclosure.
• The PHP2Shell fix was announced on 21 October 2026.
• Website owners should ask their provider which PHP version is currently installed.
• MPiFY updated every website it hosts on 22 October 2026 and found no signs of early compromise.

‍