If your website runs on WordPress, Drupal, Joomla, Laravel or almost any shared hosting plan, PHP2Shell is a threat you cannot ignore. On 21 October 2026 the PHP team pushed out emergency updates for two bugs that let a complete stranger on the internet run their own code on your server. No password. No login. Just one carefully crafted request.
The security world has nicknamed the pair PHP2Shell, and together with a string of other hacks that same week, October 2026 is now being called Black October. Whether you run an online store in Lahore, a clinic website in Islamabad or a small blog from Karachi, here is what actually happened, in plain language, and the exact steps to make sure your site is not next.
What Is PHP2Shell, in Plain Words?
PHP2Shell is the nickname for two critical bugs inside PHP itself, the programming language that powers roughly three out of every four websites on the internet. They are officially tracked as CVE-2026-109618 and CVE-2026-109619, and each one scores 9.2 out of 10 on the CVSS v4.0 severity scale. That is about as serious as it gets.
The scary part is not only that they allow remote code execution. Instead, it is where they happen. The attack fires while PHP is still unpacking an incoming request, before your WordPress theme, your login page or any security plugin has even woken up. So:
- No account is needed. An anonymous visitor can do it.
- Your plugins cannot stop it. The bug triggers before your application code runs.
- It can be completely silent. Researchers at Datadog Security Labs note that a successful attack may still return a perfectly normal “200 OK” page, with no crash and no error.
In short, the name says it all. Send PHP the right request and you get a shell, which is a command line on someone else’s server. Security researchers at Wiz demonstrated working attacks against WordPress, Drupal and Joomla sites, the same platforms thousands of Pakistani businesses rely on every day.
Why Did PHP2Shell Happen?
Both bugs come down to PHP tidying up badly after something goes wrong in the middle of a request. Think of a waiter who drops a tray halfway to the table, then serves the next customer from the half-cleaned floor.
| CVE | What Goes Wrong | In Everyday Terms |
|---|---|---|
| CVE-2026-109618 | PHP runs out of memory while it is still setting up request data. The cleanup code then treats half-built data as if it were valid. | The attacker makes the request deliberately huge so PHP chokes, and the mess it leaves behind becomes the doorway in. |
| CVE-2026-109619 | Internal state from one request survives after its memory has been freed. The next request on the same worker can pick up that stale data. | Leftovers from one visitor get handed to the next one, and an attacker can shape those leftovers. |
In addition, two default settings made the situation worse. PHP’s normal memory limit gives attackers a predictable point at which to trigger the first bug. On top of that, a feature called session upload progress, which is switched on by default, runs even on sites that never use sessions at all. As a result, that opened the path for the second bug.
There is also a new twist this time. According to the Black October summary on Wikipedia, the research behind PHP2Shell used AI-assisted vulnerability discovery and exploit development. Bugs that had been sitting quietly in PHP’s core for years were found and turned into working attacks far faster than ever before. If you follow how quickly technology is moving, from projects like the new IT Park in Islamabad to headline gadgets like the Tesla flying car, this is the darker side of the same speed.
Why Is Everyone Calling It Black October?
Because PHP2Shell did not arrive alone. In the space of a single week, several separate security failures hit core pieces of the internet, and many of them pointed to the same uncomfortable trend: AI is speeding up how fast flaws are found and exploited. Ironically, it all landed during Cybersecurity Awareness Month.
| Date (2026) | What Happened |
|---|---|
| 17 October | Amazon’s honeypots record the first PHP2Shell exploit attempts, four days before the public fix. The same day, weak private keys are reported in eight intermediate certificates run by Indian certificate authority eMudhra. |
| 20 October | Details of the PHP bugs leak on social media, ahead of the planned coordinated disclosure. |
| 21 October | PHP ships emergency fixes. On the same day, a malicious LiteLLM release on PyPI steals cloud keys and AI API tokens, and GitLab patches its own remote code execution flaw. |
| 22 October | eMudhra announces it will leave the global SSL/TLS certificate business. |
| 23 October | Palo Alto Networks’ Unit 42 reports attackers using agentic AI after a PHP2Shell break-in at a European government body, reaching password hashes and MFA secrets within two hours. |
Put together, it felt less like a bad week and more like a warning shot for everyone who runs anything online. That is where the name comes from. You can read the detailed technical write-ups from Unit 42 and watchTowr.
Is PHP2Shell Resolved? Where Things Stand Right Now
Short answer: the fix exists, but the problem is far from over. PHP has released patched versions. However, millions of servers simply have not installed them yet. Here is the picture as of 26 October 2026:
- Patches are out. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both bugs, as confirmed in the official PHP security advisory.
- Older versions are the danger zone. PHP 8.1 and below get no official release. The PHP team published minimal source backports for 7.4, 8.0 and 8.1. PHP 7.3 and older, including PHP 5, have no fix at all.
- The exposure is huge. Unit 42 counted more than 22.6 million internet-facing instances that are potentially vulnerable.
- Many sites are still unpatched. In a self-selected sample of 3,532 sites checked between 21 and 25 October, Brandefense found 59% still showing a pre-fix PHP version.
- Attacks are happening. Amazon, watchTowr, Cloudflare and HKCERT report exploit attempts, and public proof-of-concept code is circulating. Reports of confirmed, successful break-ins are still mixed.
- Governments are sounding the alarm. CISA advised that anyone who cannot update right away, or who still runs PHP 8.1 or older, should take those systems offline until patched. CERT-EU, Germany’s BSI and Canada’s Cyber Centre have issued advisories too, as summarised by Greenbone.
One more caution from Datadog’s researchers: the patch closes the known attack, but the underlying coding pattern may still hide similar bugs. Expect follow-up updates in the coming weeks.
What PHP2Shell Means for Websites in Pakistan
A huge share of Pakistani business websites sit on affordable shared hosting, often built once by a freelancer and then left alone for years. Unfortunately, that is exactly the kind of setup most at risk here, because old PHP versions tend to stay in place until something breaks. If your site was made in 2019 and nobody has touched the server settings since, assume it needs attention today.
Fortunately, most local and international hosts let you switch PHP versions from the control panel in a few clicks. The fix is usually quicker than making a cup of chai. The same mindset you would use to secure your crypto applies to your website: small, regular updates protect you from big, expensive surprises.
How to Secure Your Website From PHP2Shell: A 7-Step Checklist
Do not panic, but do not put this off until next week either. Work through these steps in order.
Check and Patch Your PHP Version
- Find out which PHP version you run. Check your hosting panel (cPanel, Plesk or hPanel), look in WordPress under Tools, then Site Health, then Info, then Server, or run
php -von the server. The command-line version can differ from the one actually serving your site, so check the web version. - Compare it with the fixed versions. You are protected from PHP2Shell only on these versions or newer:
PHP Branch Minimum Safe Version Official Changelog 8.5 8.5.12 ChangeLog 8.5.12 8.4 8.4.27 ChangeLog 8.4.27 8.3 8.3.36 ChangeLog 8.3.36 8.2 8.2.35 ChangeLog 8.2.35 8.1, 8.0, 7.4 No official release Source backports or a vendor patch; upgrading is strongly advised 7.3 and older No fix available Upgrade now - Update PHP. On your own server, install your Linux distribution’s security update. Distributions received the patches in advance and may backport the fix without changing the version number, so check their advisory. Official downloads are available for source code and Windows. On shared or managed hosting, switch to the newest PHP version in your panel and open a support ticket asking your host to confirm the PHP2Shell patch in writing.
- Restart every PHP worker. The fix only takes effect after PHP-FPM, Apache or LiteSpeed restarts. If you use Docker, rebuild and redeploy your images.
Temporary Fixes and Damage Checks
- Cannot update today? Reduce the risk. The PHP advisory lists temporary measures. None of them make you safe on their own:
- Set
session.upload_progress.enabled=0inphp.inior the FPM pool, then restart the workers. - On PHP 8.5, also set
fatal_error_backtraces=0. - Cap the request body size at your web server, proxy or firewall, and keep
post_max_sizelow (8M, or 32M if you need uploads). - Put a web application firewall such as Cloudflare in front of the site, or restrict public access entirely, as CISA advises for systems that cannot be patched.
- Set
- Check for signs of a break-in. Look for oversized form uploads with field names like
PHP_SESSION_UPLOAD_PROGRESS, “Allowed memory size exhausted … on line 0” errors, worker crashes, unknown.phpfiles in upload folders, new admin users, or a web process launching a shell. Datadog’s detection guide goes deeper. - If anything looks off, assume compromise. Restore from a clean backup taken before 17 October, then change every password, database credential and API key connected to that server.
Official references: PHP security advisory, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp, NVD CVE-2026-109618, NVD CVE-2026-109619 and the CISA alert.
Frequently Asked Questions
Is My WordPress Site Affected?
If it runs on a PHP version older than the ones in the table above, yes. WordPress itself is not the bug, PHP is, so updating plugins alone will not save you.
I Am on Shared Hosting. Do I Need to Do Anything?
Yes. Pick the newest PHP version in your hosting panel and ask your host in writing whether their servers carry the PHP2Shell fix.
Will a Security Plugin Protect Me?
No. The attack fires before WordPress or any plugin loads. However, a firewall in front of the server can help; a plugin inside it cannot.
My Site Looks Fine. Could I Still Have Been Hacked?
Yes. You cannot tell from the front end, because a successful attack can return a normal page. Check your logs and files using step 6 above.
The Bottom Line
Black October is a reminder that the boring stuff, like updating PHP, is what keeps your business online. After all, the fix takes minutes. In contrast, cleaning up after a hacked server takes days, sometimes weeks, and can cost you customers who trusted you with their details. Check your PHP version today, update it, and share this guide with anyone you know who runs a website. They will thank you for it.
For more tech news, events, travel ideas and the best deals across Pakistan, stay connected with Hello Salam Pakistan.
