%20(1).webp)
This page brings together the guidance for PHP2Shell in one place.
Am I Vulnerable?
If you get PHP from a Linux distribution or a hosting provider, check their advisories for backported fixes, which may use different version numbers.
What Is PHP2Shell?
PHP2Shell is the name researchers gave to two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a server that runs PHP, without logging in. PHP itself has not used the name.
What Is the Impact, and Who Is Vulnerable?
PHP runs a large share of the web, including WordPress, many e-commerce platforms and many internal tools. Any internet-facing application on an unpatched PHP version may be exposed. A Miggo search of Shodan found more than 2.2 million internet-facing hosts reporting PHP. Whether a specific server can be exploited depends on its version, configuration and deployment, as PHP's advisories explain.
What Is the Timeline?
Details leaked on October 20, and PHP announced an out-of-cycle release the same evening. PHP published fixes and advisories on Oct 21, 2026.
What About PHP 8.1 and Older?
These versions are end of life, and PHP has not announced fixes for them. Plan the upgrade, check whether your Linux distribution or hosting provider offers a backported fix, and in the meantime protect the application with WAF rules and runtime detection, or take it off the public internet.
What Should Security Teams Do Immediately?
Patch, starting with internet-facing systems. Deploy WAF rules to mitigate while you patch. Add runtime detection for PHP workers launching unexpected processes. Review your logs for unusual form submissions and unexpected processes on PHP servers.
Does a WAF Protect You?
A WAF reduces risk, but it is not enough on its own. The attack targets how PHP processes a request, and a WAF does not see the request the way PHP does, so generic rules can be bypassed by reshaping the request. Rules that block the feature involved can also affect legitimate uploads. Use WAF rules as one layer, keep them updated, add runtime detection, and patch.
Can Attackers Get Around WAF Rules, including Miggo's?
Any WAF rule can be bypassed, including ours. Now that the patch is public, attackers can study what changed and reshape their requests until a rule no longer matches. Generic rules written before the technical details were public are the easiest to get around.
The difference is what happens next. WAF protection for a threat like this cannot be a one-time rule. The core of Miggo's autonomous mitigation is a continuous protection loop: our research team tests our rules against new proofs of concept and bypass techniques as they appear, and we keep updating the rules for as long as the threat keeps evolving. AWS WAF customers get these updates as new versions of Miggo's HET Ruleset.
In addition to the WAF, Miggo's runtime sensor detects the attack by its behavior inside the application, so it does not depend on recognizing a specific request.
Why Did Websites in Belgium and the Netherlands Go Offline?
On October 21, several organizations, including government services, a hospital and major media groups, took websites offline as a precaution while they assessed their exposure. Their notices described the outages as maintenance. Source: The Brussels Times
Need Assistance?
Talk to the Miggo team about protecting your PHP applications while you patch.
Related reading:
.webp)
.png)