If you have been seeing "PHP hacked", "PHP vulnerability" or "PHP2Shell" everywhere lately — in tech news, on Twitter, or from developer friends — you are not imagining it.
This is real. It is serious. And most PHP website owners have no idea they are vulnerable right now.
Let me break it down simply. No jargon. No panic. Just fix it.
🤔 Who Is This Blog For?
Everyone. Seriously.
- Website owners
- Web developers (PHP, Laravel, WordPress, CodeIgniter)
- Beginners who just heard about this and are confused
- Anyone running a PHP website — even on shared hosting
🐚 What Is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities:
CVE-2026-109618CVE-2026-109619
Both are rated CVSS 9.2 out of 10 — that is near-maximum severity.
In plain English:
An attacker with no login, no account, and no prior access to your website can run any command they want on your server. Delete files. Steal data. Install malware. All without you knowing.
Affected PHP versions:
| Branch | Vulnerable Below |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| PHP 8.1 and older | ❌ No official patch ever |
Real attacks are already happening. Security researchers found PHP2Shell was used to compromise 24 firewalls — including US government-affiliated targets — in under 15 minutes.
🔍 Step 1: Check If Your Website Is Vulnerable
A security company called Assetnote released a free, safe scanner.
✅ It does NOT exploit anything. It just sends a large request and checks if your server crashes — which signals vulnerability.
Install dependencies:
pip install h11 tqdm Download the scanner:
Get it from the official GitHub:
👉 https://github.com/assetnote/php2shell-scanner
⚠️ Important: Only run the scanner against websites you own or have permission to test. Running it against others' websites without permission is illegal.
Run it against your website:
python scanner.py -u https://yourwebsite.com --verbose What the result means:
| Result | Meaning |
|---|---|
[VULNERABLE] | 🔴 Patch immediately |
[NOT VULNERABLE] | 🟢 You are safe |
[FIXED] | 🟢 Already patched |
[INCONCLUSIVE] | 🟡 Check PHP version manually |
🖥️ Step 2: Check Your PHP Version Manually
php -v If you see anything below the versions in the table above — you are vulnerable.
For example this is vulnerable:
PHP 8.2.12 (cli) (built: Oct 24 2023) This is safe:
PHP 8.2.35 (cli) (built: Oct 26 2026) 🔧 Step 3: Fix It
On XAMPP (Windows):
- Go to 👉 https://windows.php.net/download
- Download PHP 8.2.35 Thread Safe (VS16 x64)
- Extract it into
C:\xampp\php\— replace all old files - Copy your old
php.iniback from your backup - Restart Apache from XAMPP Control Panel
On Ubuntu / Debian Server:
sudo apt update && sudo apt install php8.2 php -v On cPanel Hosting:
cPanel → Software → Select PHP Version → Choose 8.2.35 or higher On Shared Hosting:
Contact your hosting provider and simply ask:
"Can you update my PHP to the latest stable version? There is a critical security vulnerability in older versions."
Most good hosts like SiteGround, Kinsta, and Cloudways have already patched this automatically.
✅ Step 4: Verify the Fix
Run the scanner again:
python scanner.py -u https://yourwebsite.com --verbose You should now see:
[NOT VULNERABLE] https://yourwebsite.com - Verdict: FIXED That means you are safe. 🎉
🧠 Understanding What Actually Happened (Techy Part)
For those who want to know the actual mechanism:
PHP has a feature called session upload progress that tracks file uploads. Under specific memory conditions, PHP runs out of memory (OOM) mid-request before resetting its internal state. A follow-up request from an attacker in the same server worker process can then read that stale memory — leaking internal memory addresses.
With those addresses, the attacker builds a second crafted request that writes a forged object into PHP's memory, hijacks the execution flow through a technique called a ROP chain, and lands inside zif_system — PHP's internal function that runs shell commands.
The result: remote code execution with no login required.
That is why the patch says "Avoid state corruption via bailout" — it resets request state properly before memory is exhausted.
💬 Now Go Tell Your Friends
Next time someone says "PHP is vulnerable" — you can say:
"I already checked mine and fixed it. Now it's your turn."
If your website is simple, this guide is enough to do it yourself.
If your setup is complex — custom server, Docker, multiple PHP versions, or you are just not sure — drop a comment below and I will help you out.
Found this helpful? Share it with a PHP developer friend who might not know about this yet. You might save their website today.
