On October 21, 2026, the PHP project released emergency fixes for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell.” Researchers at Calif (working with OpenAI) and Wiz discovered them, and both are rated critical (CVSS v4.0 9.2). Together they can let an attacker take over a web server with a few crafted requests: no password, no user action and no mistake in the website’s own code. Because this happens beneath the application, website logs and firewalls may show little.
The same day, the NSA urged organizations to patch immediately, warning that cyber actors are likely to weaponize the flaws to steal data, disrupt services and move deeper into networks. Details leaked online the day before the official release, and public exploit code is already circulating. watchTowr has observed exploitation attempts against both flaws in its honeypot network, though major threat intelligence firms have not yet reported successful attacks. The window to patch is closing fast.
PHP runs a large share of the web, from WordPress and online stores to internal portals and the admin screens of network appliances. Internet scans cited by Recorded Future found about 4.4 million internet-facing PHP services at disclosure, and roughly 79% of those that report a version run a branch that no longer gets updates. Every one of those sites is exposed until it’s patched.
Both flaws are in how PHP cleans up after an error. An attacker sends requests designed to make PHP crash or run out of memory. PHP is then left using data it shouldn’t trust:
Either flaw can lead to a full server takeover. Because this happens beneath the application, website logs and firewalls may show little.
Patching protects your own servers. It doesn’t protect your employees from the thousands of other websites that won’t be patched in time. Most servers get PHP through Linux distribution packages, so fixes take time to test and roll out, and poorly maintained sites may never get them.
Hacked legitimate websites are valuable to attackers because they keep their good reputation. Attackers can use them to host phishing pages that run unnoticed for months, fake software updates and malware, redirect visitors to scams and malicious downloads, and poison search results and ads. URL filters that judge sites by their history let that traffic straight through. Stopping it takes analyzing what each page actually does when it loads.
Menlo Security is not a fix for PHP2Shell; patching is. Menlo limits the damage in two ways: it shields the internal apps you can’t patch yet, and it protects your users from the websites that won’t be patched.
Table 1: How Menlo Security limits the damage from PHP2Shell.
PHP2Shell is critical, easy to weaponize and under heavy attack, with no confirmed compromises yet. Patch now, find every system that runs PHP, retire what you can’t fix and shield what you can’t retire. But patching protects your servers, not your people. When the websites they trust are the ones that get hacked, prevention has to extend to the browser. Learn how Menlo Security shields internal apps and stops web-borne attacks before they reach your users at menlosecurity.com.
Menlo Security
