If you run a website on PHP, use WordPress, or deploy any PHP application on a server, this one matters to you. PHP’s core engine has been found with two serious vulnerabilities, collectively called PHP2Shell, tracked as CVE-2026–109618 and CVE-2026–109619.
In this article, I’ll explain what the problem is, which PHP versions are at risk, and what you should do right away. I’ve kept the technical details simple so that both developers and non-developers can follow along.
What Is PHP2Shell?
PHP2Shell isn’t a single bug. It’s a group of two vulnerabilities in PHP’s internal request and memory handling, and both share one root cause, which is why they’re treated together.
In plain terms:
The first vulnerability happens when PHP runs out of memory (an out-of-memory condition) while a request is being processed, and internal request data is only partially initialized at that point.
The second vulnerability involves internal state that outlives the memory it depends on…
