PHP2Shell and the 69% Problem: What’s at Risk, What to Fix – A Rensai Labs Security Brief
The biggest cybersecurity threat of 2026 has a name. PHP2Shell. This vulnerability family, tracked under CVE-2026-109618 and CVE-2026-109619, has been assigned a critical severity score of 9.2 out of 10 under CVSS v4.0.
The threat level is red. It doesn’t get any higher. PHP powers roughly 69% of websites with a known server-side language. If your servers run vulnerable PHP versions, attackers could execute arbitrary code remotely without login credentials. From there, they could steal sensitive data, implant malicious code, or infiltrate your company’s internal network. And that’s just the tip of the iceberg.
To help companies respond, Rensai Labs‘ team of 75+ PHP developers and cybersecurity experts analyzed the threat as of late October 2026.
The findings are in. So is our emergency action guide. Is your business vulnerable? What should you block right now? And how can you defend it?
Security Checkup: 3 Questions for Rensai Labs’ Chief Architect
The moment details of PHP2Shell went public, we began urgently auditing and monitoring client infrastructure. Throughout the first assessments, business owners kept asking the same three questions.
Question 1: “Our custom code is clean, and our CMS and all plugins are up to date. Why are we still at risk?”
Rensai Labs‘ Chief Operating Officer, Andrej Suschevich, breaks down the technical risks behind PHP2Shell and explains why standard application security measures aren’t enough in this case:
“The problem lies beyond the control of any CMS. A malicious HTTP request can corrupt the PHP engine’s internal structures while incoming data is being parsed. In affected configurations, attackers may execute malicious code before the application runs its usual authentication and security checks. Protecting an application without updating PHP itself is like locking the doors of a house that’s already on fire.“
Question 2: Can hackers actually compromise our server without knowing our admin login credentials?
Yes, they can. What makes CVE-2026-109618 and CVE-2026-109619 particularly dangerous is their Pre-Auth RCE capability. This allows attackers to execute code remotely without authentication, potentially gaining full control of the server.
“No admin passwords, no two-factor authentication, no active user sessions required. All it takes is one carefully crafted HTTP request to any publicly accessible URL on your website.
Because of memory corruption in the PHP core, the engine executes the attacker’s commands with web server privileges. The result? The hacker can instantly steal customer databases, API keys, and trade secrets, then infiltrate the company’s internal network.”
Question 3: Will tweaking php.ini settings or enabling a Web Application Firewall (WAF) protect us?
“Configuration changes and WAF rules are temporary fixes at best. They may reduce exposure to certain attack vectors, but they can’t fully protect your system. The vulnerability sits deep inside the PHP engine, where application-level defenses simply cannot reach.”
What’s at Risk in a PHP2Shell Attack and What Really Happens to Your Business
The attack hits the PHP core before your website even gets a chance to verify passwords or run security plugins. So what does your business stand to lose in the first few minutes of a compromise?
Attackers immediately gain web server process privileges (www-data or apache). From there, the damage follows a predictable chain of events.
Anatomy of a Breach: The First 5 Minutes of a Server Compromise
- Persistent Access Through Hidden Backdoors (Web Shells)
First, the attacker plants malicious scripts in your website’s system or temporary directories. The real danger? Even if you patch PHP tomorrow, the implanted web shell stays behind, allowing the attacker to maintain access to your system.
- Sensitive Data Leaks from Server Memory
CVE-2026-109618 gives attackers a way to read PHP process memory. When crash dumps expose that memory through PHPSESSID-related HTTP headers, sensitive information can leak out, from database passwords and active session tokens to API keys and private TLS certificates.
- Expanding the Attack
The attack doesn’t have to stop at your website. Once hackers compromise the web server, they can use it as an entry point into your internal network, putting customer databases, ERP, and CRM systems at risk.
The “No PHP” Myth
Let’s face it. PHP2Shell poses a serious threat to websites running vulnerable PHP versions, including those built on WordPress, Drupal, Joomla, Magento, Laravel, or Symfony.
What’s surprising is that most business owners don’t even know their websites run on PHP.
A recent Rensai Labs client audit revealed a familiar misconception. Some clients were certain their core applications relied on Java, Python, or Go for backend development, not PHP. But one overlooked subdomain running a PHP-based marketing site, blog, or press site is enough to put PHP2Shell on your radar too.
Even tech giants and major institutions like Slack, Pfizer, and the University of California use PHP technologies (WordPress VIP, Laravel, and Drupal) for their careers and media websites, including sites like jobs.universityofcalifornia.edu. A single vulnerable server on the edge of the network can become a convenient bridge for attackers into the company’s entire internal network.
4 Industries Most Affected
While any server running a vulnerable PHP version is at risk, four industries face the greatest cascading damage because of the money and sensitive data they handle.
- Healthcare. Appointment booking, lab results, and patient portals often rely on PHP backends. With CVE-2026-109618, healthcare organizations have more than server security to worry about. A successful PHP2Shell exploit could put doctors’ sessions, database credentials, and unencrypted patient records in attackers’ hands.
- E-commerce. A PHP2Shell attack could let hackers plant JavaScript skimmers on checkout pages or steal customer databases. Beyond fraud and downtime, businesses could face PCI DSS 4.0 penalties, lose bank payment processing services, and lose customers.
- Legal services. An NDA won’t save your firm if a portal vulnerability leaks your clients’ tax dispute records or documents from corporate conflicts. The reputational damage could happen overnight.
- Financial services. Attackers could steal payment details, compromise API integrations, and expose user accounts. In finance, putting off a patch comes at a price – direct losses from fraud, partner banks urgently revoking SSL certificates, and regulatory paralysis.
What to Fix: A Step-by-Step Guide to Protecting Against PHP2Shell
Looking for a quick fix, many companies settle for tweaking php.ini or enabling a WAF. But Rensai Labs warns that these measures alone can create a false sense of security.
“WAF rules and disabled settings are temporary fixes, nothing more,” Andrej Suschevich explains. “Only updating the PHP binaries to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12, followed by a mandatory restart of php-fpm or Apache, can guarantee 100% protection.
Skip the restart, and your server keeps running vulnerable PHP code from memory.”
4 Urgent Steps for Your IT Department
Step 1. Identify PHP Installations and Check Versions
Scan every internal and external service for PHP. Don’t overlook forgotten subdomains running blogs, press sites, or promotional pages. They could be exposed too.
Step 2. Upgrade to Patched PHP Versions
Update PHP immediately to an official patched version: 8.2.35, 8.3.36, 8.4.27, or 8.5.12. If you’re using pre-configured virtual appliances or Docker containers, make sure to deploy the latest official patched builds.
Step 3. Restart PHP Services (Do Not Skip!)
Run systemctl restart php-fpm or systemctl restart apache2 to fully restart the services. Installing the patch alone isn’t enough. Without a restart, existing processes will keep running the old, vulnerable PHP code from memory.
Step 4. Check for Hidden Web Shells
Search your file system and temporary directories (/tmp, /var/tmp) for newly added malicious scripts. Attackers may have planted them before you patched PHP.
What to Do Right Now: 3 Options to Consider
- Hope for the Best and Rely on Your WAF
Everything stays as it is. Your security plugin or WAF makes you feel protected. But one unusual POST request could break through the PHP engine before the WAF has a chance to react.
- Assign the Task to Your IT Team
Best case, your system administrator updates the php-cli package but forgets to restart the php-fpm or Apache workers. The website keeps running vulnerable PHP code from memory.
Worst case, the server gets updated, but the shopping cart or customer account portal breaks, and rolling everything back takes half a day.
- Let Rensai Labs Engineers Handle It
What Rensai Labs Handles for You
From start to finish, we manage the security of your entire PHP stack without disrupting your business.
- Safe Deployment in a Test Environment
Our team replicates your environment, including Docker containers or legacy CentOS 7 servers. Next comes compatibility testing against patched PHP versions (8.2.35 / 8.3.36 / 8.4.27). Only after that do we update your production server.
For older systems running PHP 5.4-8.1 without official security patches, our legacy software modernization expertise enables the development and testing of packages with backported fixes.
- Retrospective Threat Hunting
Patching PHP doesn’t tell you whether attackers got in earlier. Security engineers go back through 30 days of logs and scan the file system to check for hidden web shells planted in /tmp before the update.
- Keep Your PHP Systems Under Our Watch
Rensai Labs’ team includes 75+ PHP developers and DevOps engineers. Beyond fixing the vulnerability in as little as 2 hours, we can take over the ongoing support and maintenance of your website, portal, or CRM.
