PHP2Shell Explained: Affected Versions, Guidance and Detection

Your WordPress plugins are patched. Your custom app passed its last pentest. And your server can still be taken over without a single login.

That is the uncomfortable message behind PHP2Shell, a family of critical memory-safety flaws in the PHP runtime itself, rated up to CVSS 9.2. PHP powers roughly 70% of websites, which makes this one of the most significant vulnerabilities of 2026. Within a week of the patch, working exploits had hit honeypots. Across Europe, government websites went offline as a precaution, and Germany’s BSI told operators to disconnect affected servers if in doubt.

In this post we break down what PHP2Shell is, why it hides so easily in real environments, and how Autobahn Security helps you find every exposed PHP runtime before an attacker does.

What is PHP2Shell?

Two details make this worse than a typical CMS bug:

• The application doesn’t need to be vulnerable. The flaws live in the PHP runtime, so a perfectly coded app on an unpatched PHP is still exposed. The research confirmed RCE through application-level code paths, not just WordPress.

• Memory disclosure is a breach on its own. Leaked worker memory can contain passwords, session tokens, API keys and certificates from other users’ requests, with no malicious code ever executed.

The researchers traced affected releases back to PHP 5.4, and nearly every version had at least one of the issues. The PHP team shipped fixes on 21 October 2026.

Older, end-of-life branches (8.1 and below, PHP 7, PHP 5) get no fix. If you run them, upgrading to a supported branch is the only path.

• Before 21 Oct: Amazon Threat Intelligence saw scanning and non-working exploit attempts four days before the patch.

• 21 Oct 2026: PHP releases the fixed versions. CERT-EU alerts trigger preventive shutdowns of government websites in the Netherlands, Germany, Czechia, Finland, Denmark, France and Belgium.

• 26 Oct 2026: A honeypot running PHP 8.4.26 on Apache mod_php records a confirmed remote code execution. The US agency CISA adds PHP2Shell to its Known Exploited Vulnerabilities catalog.

• 28 Oct 2026: Germany’s BSI issues an official warning at level 3 (Orange), its second-highest.

VirusTotal estimates more than 5.1 million PHP hosts are reachable online, about 3.8 million with at least one port open to attack. Most organisations own more of them than they think. The usual blind spots:

• “We updated the app” isn’t “we updated PHP.” A WordPress or Drupal update never touches the runtime underneath it.

• Forgotten assets. Old marketing microsites, staging servers, admin panels and acquired-company domains often run years-old PHP nobody owns any more.

• Patched but not restarted. Apache, PHP-FPM and long-running workers keep the vulnerable binary in memory until they are restarted.

• Shadow IT and hosting providers. Sites on shared hosting or agency-managed servers sit outside your patch process entirely.

You can’t patch what you don’t know is there. That is where an outside-in view of your attack surface matters.

Autobahn Security finds vulnerable PHP runtimes across your external attack surface and turns them into a clear, prioritised fix. Here is how it works:

1. Map every asset. Autobahn brings your domains, IPs and cloud assets into one inventory, including the forgotten subdomains and staging hosts that rarely make it into a patch plan. Integrations with your CMDB and existing tools fill in the gaps.

2. Fingerprint the PHP runtime. The built-in scanner, which checks for 100,000+ potential issues, identifies web servers running PHP and the version they expose, then flags any runtime below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or on an end-of-life branch.

3. Prioritise from an attacker’s perspective. Autobahn groups findings by root cause, so 40 hosts on an outdated PHP become one issue to solve, not 40 tickets. Pre-authentication RCE with confirmed exploitation and a KEV listing sits at the top of the list.

4. Hand your team a Cyber Fitness Workout. Each finding comes with a step-by-step remediation guide your IT team can follow: which PHP version to install, which services to restart, and what to harden afterwards. Workouts can go straight to Jira or other ticketing tools.

5. Verify and track. Rescan after patching to confirm the fix, and watch your Hackability Score improve as exposure drops.

A note on accuracy: version-based detection has limits. Some Linux distributions backport security fixes without changing the version string, and servers with expose_php = 0 hide their version. Autobahn’s analysts and your asset owners can confirm these edge cases, and the platform lets you mark verified false positives so they stop cluttering your view.

Upgrading PHP is the only complete fix. The steps below follow the guidance published on php2shell.com.

• Upgrade every PHP runtime to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. Move end-of-life branches to a supported one.

• Restart Apache, PHP-FPM and any long-running workers so the patched binary is actually loaded.

• Check custom apps and containers too. Base images, bundled runtimes and appliances need attention too, not just your main servers. NCSC-NL’s vendor list shows which third-party products are affected.

• If you can’t patch today, reduce exposure. Setting memory_limit = -1 may block some attack paths, but pair it with a cgroup v2 memory.max limit. Don’t use RLIMIT_AS or RLIMIT_DATA instead; the PHP advisory warns they trigger the same vulnerable paths. Disable PHP error display and reduce worker reuse.

• Harden after patching. Review memory_limit against request sizes, keep post_max_size below your memory budget, and set max_input_nesting_level to what your app needs.

• Rotate secrets on exposed hosts. If a server ran a vulnerable version while internet-facing, treat credentials, tokens and keys in its memory as potentially leaked.

One more thing to watch: a separate, still-unpatched PHP flaw (CVE-2026-115560) affects only unusual configurations. PHP recommends setting session.upload_progress.enabled=0 as a mitigation.

PHP2Shell went from patch to confirmed in-the-wild exploitation in five days. The organisations that come through it safely won’t be the ones with the best apps. They’ll be the ones who knew where every PHP runtime was and patched it first.

Autobahn Security shows you exactly which of your assets are exposed, ranks them by real attacker risk, and gives your team the workout to fix them.

→ Book a demo or run a scan at autobahn-security.com