Critical PHP Security Vulnerabilities in 2026: How Hackers Exploited the Risk and How to Protect Your Website

The global cybersecurity community faced a serious security emergency in October 2026 after researchers disclosed two critical vulnerabilities in PHP, one of the programming languages widely used to build and operate websites.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were associated with a security issue known as php2shell. Under vulnerable configurations, attackers could potentially exploit these flaws to execute malicious code on a server without authentication.

The disclosure triggered an urgent response from PHP developers, cybersecurity agencies, cloud service providers, and website operators. Security updates were released, some organisations temporarily took services offline, and Cloudflare reported a sharp increase in attempted exploitation following public disclosure.

The incident highlights an important reality for businesses: a website can be professionally designed and still be vulnerable if its underlying software, server configuration, or security controls are not maintained.

In this article, we explain what happened, how the vulnerabilities could be abused, what the emergency patches address, and how website owners can strengthen their defences.

What Happened in the October 2026 PHP Security Emergency?

On October 21, 2026, the PHP project published security updates addressing two critical vulnerabilities that could allow remote code execution under affected conditions.

Remote code execution, commonly abbreviated as RCE, is a serious class of security vulnerability. If successfully exploited, it can allow an attacker to execute commands or code on a vulnerable system from another computer.

The risks extended beyond websites that explicitly advertise themselves as PHP applications. PHP is used by numerous content management systems, e-commerce platforms, web applications, hosting environments, and third-party products.

According to the official PHP security advisory, the emergency updates included:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

These releases address the two critical vulnerabilities disclosed on October 21.

The United Kingdom's National Cyber Security Centre and European cybersecurity authorities also urged organisations to identify affected systems and apply the appropriate security updates.

The response demonstrated how a vulnerability in a widely deployed software component can quickly become a global infrastructure concern.

What Is php2shell?

The term php2shell was used in reporting about the two PHP vulnerabilities.

To understand the risk, it helps to distinguish between an ordinary website error and a vulnerability that can compromise a server.

An ordinary application error might cause a page to fail or return an error message. A remote code execution vulnerability can have much more serious consequences because it may allow an attacker to execute code outside the application's intended behaviour.

The two disclosed vulnerabilities involve problems with PHP's internal memory management and request-processing state.

1. CVE-2026-109618: Out-of-Memory Handling and Memory Corruption

The first vulnerability involves an out-of-memory condition.

When software runs out of available memory during an operation, it must handle that condition safely. The PHP advisory describes a problem in which memory-related failure can interrupt request processing while internal request data is only partially initialised.

During subsequent cleanup, PHP may incorrectly treat that incomplete data as valid.

Under vulnerable conditions, this can result in memory corruption and potentially allow an attacker to execute code remotely.

2. CVE-2026-109619: Stale Internal State

The second vulnerability involves internal state that can remain available after the memory supporting it has been freed.

This type of issue is commonly associated with a use-after-free vulnerability.

In simplified terms, software allocates memory to hold information, releases that memory when it is no longer needed, and should then stop using it. If the software later accesses the released memory through an invalid reference, its behaviour may become unsafe.

The PHP advisory explains that request-owned internal state may survive after its backing memory has been freed. A later request handled by the same worker may then encounter that stale state before normal initialisation resets it.

Depending on the environment and circumstances, this can create an opportunity for remote code execution.

Important: These are different technical failure modes. They should not be confused with a routine WordPress plugin vulnerability or an ordinary website configuration error.

How Could Hackers Misuse These Vulnerabilities?

The principal concern was the possibility of exploiting vulnerable PHP installations through specially crafted HTTP requests.

HTTP is the protocol browsers and servers use to communicate. Websites routinely receive requests containing page addresses, headers, form submissions, cookies, and other data.

If a vulnerable server processes a malicious request in a way that triggers a flaw in PHP's internal handling, an attacker may be able to move beyond ordinary application functionality.

Depending on the successful exploit and the privileges available to the compromised process, potential consequences include:

Remote code execution: An attacker may execute unauthorised code on the affected server.

Sensitive data exposure: Information accessible to the compromised application or process may be at risk, including files, application data, or credentials.

Website compromise: Attackers may attempt to alter website content, install unauthorised files, or establish persistent access.

Service disruption: Malicious activity may affect application availability or consume resources.

Further compromise: If the compromised service has excessive permissions or access to other systems, an attacker may attempt to move beyond the original application.

These are potential consequences of successful exploitation, not proof that every vulnerable website experienced a breach.

The actual impact depends on the PHP configuration, the privileges of the affected process, the application environment, and any additional security controls.

It is also important to distinguish an attempted attack from a confirmed compromise. A malicious request recorded in a firewall log does not, by itself, establish that an attacker gained access or stole information.

Millions of Exploitation Attempts: What Did the Reports Say?

The incident attracted international attention because attack attempts increased rapidly after the vulnerabilities became public.

Cloudflare reported that it observed thousands of exploitation attempts before public disclosure. Following disclosure, the reported activity rose sharply, reaching millions of attempts across its network.

Reuters also reported a rush by governments and businesses to patch affected systems, while cybersecurity organisations warned that attackers could rapidly incorporate newly disclosed vulnerabilities into their activities.

These figures describe reported exploitation attempts and observed network activity. They should not be interpreted as millions of successfully hacked websites.

The distinction matters because a single website may receive many malicious requests, while a request blocked by a security rule may never reach the vulnerable application.

Did 70% of Websites Get Hacked?

No such conclusion can be drawn from the available reporting.

PHP is widely used across the internet, and news coverage discussed estimates suggesting that PHP-related technology underpins a large proportion of websites.

However, the proportion of websites using PHP is not the same as the proportion of websites successfully compromised.

BBC News reported that an estimate suggesting roughly 70% of the internet was affected could not be independently verified by the broadcaster.

The accurate conclusion is that the vulnerabilities created a potentially broad exposure because PHP is widely deployed. The number of affected installations, successfully exploited systems, and confirmed breaches are separate measurements.

Website owners should therefore assess their actual software versions and configurations rather than relying on broad internet-wide percentages.

Why Did Some Organisations Temporarily Take Their Websites Offline?

When a critical vulnerability can potentially allow unauthenticated remote code execution, organisations must decide how to manage the risk before they can fully deploy and verify a fix.

For some organisations, temporarily disabling public access may be safer than continuing to operate an exposed service.

BBC News reported that several government organisations and other website operators took services offline or restricted access while addressing the PHP security emergency.

This approach is particularly relevant when:

• The affected software cannot be patched immediately.

• The server is publicly accessible and vulnerable.

• The organisation cannot confidently isolate the affected service.

• Security teams need time to investigate possible compromise.

• The consequences of a successful attack would be severe.

Taking a website offline is not always necessary. If a verified security update can be deployed promptly and the environment can be checked, patching may allow the service to remain available.

The appropriate response depends on the system's exposure, available mitigations, business requirements, and the advice of the relevant software vendor and security team.

Emergency PHP Patches: Which Versions Should Website Owners Install?

The PHP project released security updates on October 21, 2026, addressing CVE-2026-109618 and CVE-2026-109619.

The corresponding fixed versions are:

Administrators should use the latest appropriate security release for their supported PHP branch rather than treating these version numbers as permanent recommendations.

PHP 8.2 is approaching the end of its security-support lifecycle, so organisations using it should also plan a transition to a supported version.

PHP 8.1 and older branches no longer receive ordinary upstream security updates from the PHP project. Some operating-system vendors provide backported security fixes, so administrators should verify their vendor's support and patch status rather than relying solely on the displayed version number.

A Further Security Development: CVE-2026-115560

The situation developed further on October 23, when additional information was published about CVE-2026-115560, another remote code execution vulnerability involving a more specific combination of PHP configuration and application behaviour.

According to the Canadian Centre for Cyber Security, this issue is not addressed by the October 21 releases listed above.

The PHP project's published guidance recommends disabling the session upload progress feature as a mitigation for the relevant attack vector:

session.upload_progress.enabled=0

This setting should be reviewed with the application's requirements and the PHP project's latest advisory before deployment.

Administrators should consult current official security guidance for this additional issue and any subsequent updates. Applying the October 21 patches is essential, but organisations should not assume that doing so automatically resolves every subsequently disclosed PHP vulnerability.

How Does Cloudflare Help Protect Websites Against PHP Attacks?

Cloudflare provides services that sit between visitors and a website's origin server. Depending on the configuration and enabled products, these services can help filter malicious traffic before it reaches the application.

During the php2shell incident, Cloudflare announced that it had developed and deployed Web Application Firewall (WAF) protections before public disclosure. It reported that customers using its free or paid WAF were protected by default against the two disclosed php2shell vulnerabilities following the relevant deployment.

This was an important defensive measure because it provided an additional layer of protection while website operators worked to patch their systems.

However, Cloudflare protection should not be confused with a replacement for software updates.

1. Web Application Firewall

A WAF inspects web traffic and can block requests that match known malicious patterns or other configured security rules.

For the PHP incident, Cloudflare developed protections specifically intended to identify and mitigate attempts to exploit the disclosed vulnerabilities.

Security rules must be kept current because attackers may change their requests to try to evade existing detection methods.

2. DDoS Protection

Distributed denial-of-service attacks attempt to overwhelm a website or service with traffic.

Cloudflare provides DDoS protection designed to help keep websites available during these attacks.

However, DDoS protection and PHP remote code execution protection address different threats. Enabling one does not automatically eliminate the other.

3. Rate Limiting

Rate limiting can restrict excessive requests to selected endpoints or services.

It may help reduce certain forms of abuse, including repeated requests against login pages, APIs, or other sensitive routes.

Rate limiting is a supplementary control. It does not guarantee protection against an exploit that succeeds through a single request.

4. Origin Server Protection

A common configuration mistake is enabling Cloudflare while leaving the origin server directly accessible to the public.

If attackers can reach the origin server without passing through the intended Cloudflare security controls, they may be able to bypass those controls.

Where appropriate, organisations should restrict origin access to trusted Cloudflare traffic, configure authenticated origin connections or other supported protections, and verify that direct-origin access is not unintentionally exposed.

5. Security Monitoring

Cloudflare's dashboards and logs can help administrators investigate suspicious requests, blocked traffic, and changes in attack patterns.

These records should be reviewed alongside origin-server logs, application logs, authentication events, and other relevant telemetry.

A firewall event alone cannot prove that an attack succeeded or failed. Incident investigation should consider what reached the origin server and what happened afterward.

A Practical Checklist to Secure Your PHP Website

Website owners should treat the incident as a reason to review their wider security posture, not simply install one patch and assume the problem is solved.

Step 1: Identify Every PHP Installation

Check all systems that may run PHP, including:

• Public-facing websites.

• WordPress, Joomla, Drupal, and other PHP-based applications.

• E-commerce platforms and customer portals.

• PHP-FPM and Apache deployments.

• Containers, virtual machines, and hosting control panels.

• Third-party applications and appliances that bundle PHP.

An organisation may have more PHP installations than its main website alone suggests.

Step 2: Apply the Appropriate Security Updates

Upgrade to a fixed, supported PHP release compatible with the application and its hosting environment.

Check the relevant vendor documentation for managed hosting, operating-system packages, containers, and applications that bundle PHP.

If a system cannot be patched immediately, follow the official mitigation guidance. Consider isolating the affected service or taking it offline if the risk cannot be adequately controlled.

Step 3: Review Cloudflare Configuration

If Cloudflare is part of your security architecture, verify that:

• The relevant website records are correctly proxied.

• The appropriate WAF protections are enabled.

• Security rules are current.

• Origin-server access is appropriately restricted.

• Sensitive administrative routes have suitable access controls.

• Security events are being monitored.

The available controls depend on your Cloudflare plan and configuration. Confirm the specific protection applicable to your environment.

Step 4: Investigate Possible Compromise

Do not assume that installing a patch removes an attacker's existing access.

Review relevant logs for unusual requests, unexpected server processes, unauthorised files, unfamiliar accounts, unexpected outbound connections, and other suspicious activity.

If you find evidence of compromise, follow a proper incident-response process. Preserve relevant evidence, contain the affected system, investigate the scope of access, and rotate exposed credentials or keys as appropriate.

For serious incidents, engage qualified incident-response specialists.

Step 5: Reduce Unnecessary Privileges

PHP applications should run with only the permissions they require.

Review file permissions, service accounts, database privileges, secret storage, and access to sensitive directories. Separate application environments where appropriate and avoid giving web-facing processes unnecessary administrative access.

Step 6: Establish an Ongoing Patch Process

Security incidents often reveal gaps in software inventory and update management.

Maintain an inventory of software versions, monitor vendor advisories, test updates, and prioritise internet-facing systems. Define who is responsible for emergency updates and how changes will be verified.

A repeatable patch-management process is more reliable than waiting for the next major security incident.

Does This PHP Vulnerability Affect Every Website?

Not every website is affected in the same way.

The vulnerabilities concern PHP installations that process web requests, but exposure and impact depend on the actual software version, runtime configuration, deployment environment, and applicable security fixes.

Websites built with other technologies may not run the vulnerable PHP runtime directly, although third-party software, hosting products, or connected systems may still require investigation.

Similarly, using Cloudflare does not automatically mean a website is vulnerable or secure. The underlying software and the actual security configuration both matter.

The correct approach is to establish what software a system runs, identify the applicable advisory, verify the available patch, and assess the controls protecting the system.

What Businesses Should Learn From the PHP Security Emergency

The October 2026 incident demonstrates how a flaw in widely used infrastructure can quickly become a business risk.

A successful server compromise may affect customer information, service availability, business operations, and trust. Even when no compromise occurs, emergency maintenance and temporary outages can consume significant time and resources.

Businesses should consider three important lessons.

Security requires maintenance. Keeping a website online is not enough. Its underlying runtime, dependencies, plugins, and server environment must also remain supported and secure.

Defence in depth matters. Software updates, a properly configured WAF, restricted origin access, least-privilege permissions, backups, and monitoring work together. No single control can address every threat.

Incident response must be evidence-based. A vulnerability's severity, the number of attack attempts, and the number of confirmed breaches are different things. Organisations should take urgent action without making unsupported claims about successful attacks.

The same principles apply to corporate websites, online stores, customer portals, and other business-critical applications.

Final Thoughts

The PHP security emergency of October 2026 is a reminder that vulnerabilities in widely deployed software can demand an immediate response from organisations around the world.

The two php2shell vulnerabilities raised concerns about unauthenticated remote code execution, prompting emergency PHP updates and additional protective measures from security providers such as Cloudflare. Subsequent reporting about CVE-2026-115560 also demonstrated why organisations need to continue monitoring security advisories even after applying an initial patch.

For website owners, the priorities are clear: identify affected systems, install the appropriate security updates, configure protective controls correctly, investigate signs of compromise, and establish an ongoing patch-management process.

At Zarrar Innovations, we believe website security should be considered an essential part of building and maintaining reliable digital products. A secure website depends not only on its design and functionality, but also on responsible software maintenance, infrastructure configuration, and continuous security awareness.

Need a website security review or help improving your web infrastructure?

Visit Zarrar Innovations to learn more about our web development and digital solutions.

Website: https://zarrarinnovations.com

Contact: info@zarrarinnovations.com

Sources and Further Reading

For technical details and current remediation guidance, consult the official PHP security advisory, Cloudflare's incident-specific security explanation, and the cybersecurity agencies' published recommendations. Always verify that you are using the latest available guidance when responding to an evolving security incident.