Lessons from the Latest Critical PHP2Shell Vulnerability

A critical security flaw in PHP, technology that powers 70% of the internet, put millions of websites at potential risk. Here’s what happened, why AI is changing the cybersecurity landscape, and how Moove Agency worked with our hosting partners to protect our clients’ websites.

Imagine discovering that a vulnerability in one of the internet’s most widely used technologies could allow an attacker to take complete control of a website’s server. That is the concern behind PHP2Shell, the name given to the recent PHP security vulnerabilities disclosed on 21 October 2026.

At Moove Agency, we recognised the seriousness of the situation and worked promptly to understand the threat, establish what protective measures were being implemented and ensure the websites we manage were covered by the appropriate security response.

In this article, we explain what happened, why this incident is particularly significant in the age of AI, and how we worked with our hosting partners to help keep our clients’ websites secure.

What happened? Meet PHP2Shell

On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities:

• CVE-2026-109618 — a vulnerability involving memory corruption following an out-of-memory error.
• CVE-2026-109619 — a vulnerability involving stale internal state and memory handling.

Both vulnerabilities received a CVSS score of 9.2 out of 10, placing them in the critical severity category.

PHP is the server-side programming language that powers WordPress and many other web applications and is used by around 70% of websites worldwide.

The problem was not a faulty CMS or code. The vulnerabilities existed within PHP itself — the underlying technology that executes the code behind countless websites.

Under certain conditions, the flaws could allow an unauthenticated attacker to execute code remotely on an affected server or access sensitive data.

In practical terms, a website could be exposed even if its WordPress installation and plugins were fully up to date.

Three things made this incident particularly serious:

1. No login required. The vulnerabilities could be exploited remotely without an attacker first obtaining a legitimate access.
2. The problem was below the application layer. Updating WordPress core, replacing a vulnerable plugin or putting up a maintenance screen would not fix a flaw in the underlying PHP engine.
3. The affected code had deep historical roots. Some of the affected PHP versions are over a decade old, demonstrating that even mature, widely scrutinised software can contain serious vulnerabilities.

Interestingly, these vulnerabilities had been known about for many years, but the PHP security team had previously considered them too difficult to exploit in practice to justify an immediate fix. The emergence of frontier AI changed everything: turning long-standing, theoretical weaknesses into credible, real-world security threats.

The PHP security team, operating on consensus, struggled to choose between these [trade-offs] and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. PHP foundation

The incident is a stark reminder of how quickly the cybersecurity landscape can change. When a vulnerability affects technology used across millions of websites, a rapid, coordinated response between hosting providers, developers and website owners can make all the difference.

Is PHP2Shell being exploited in the wild?

Yes. Public proof-of-concept code began circulating before the official fixes were released, and several security companies have reported exploitation attempts.

We are now seeing php2shell exploited in the wild at scale.Security consultant – Sucuri.net

Why is the impact so serious?

Here’s what an attacker could get from exploiting this vulnerability:

• Take down PHP-based websites and applications with a single, unauthenticated request
• Run any command on the server without any visible disruption; the server would accept the attackers’ input and run all its commands
• Steal every credential the application uses: database passwords, API keys, encryption keys
• Access sensitive data: customer records, transactions, personal information, internal databases, cache systems
• Move deeper into the infrastructure: an attacker could use the compromised server as a stepping stone towards internal services, cloud resources and other systems.
• Establish persistent access that survives server restarts and redeployments
• Evade detection: malicious activity can be difficult to distinguish from normal system behaviour

How Moove Agency responded

When the PHP2Shell vulnerabilities emerged, we moved promptly to engage with our hosting partners.

Our priority was to establish the nature of the threat, understand the protective measures being implemented at infrastructure level, and confirm the status of the response for the websites we manage.

Our response included

1. Prioritising the underlying technology: Because the vulnerability affected PHP itself, we focused on ensuring that the necessary infrastructure-level mitigations and security updates were implemented.
2. Monitoring the situation: We followed industry developments to understand whether further action was required.
3. Client communication: We kept the situation under review, communicated with clients and remained ready to coordinate any additional work needed for individual websites.

What does this mean for your website?

For businesses running WordPress, the practical lesson is straightforward: keeping WordPress and its plugins updated remains essential, but it is only one part of a comprehensive security strategy.

A secure website depends on several layers working together:

• Supported software: WordPress, PHP, plugins and themes should be maintained on supported versions with security updates applied promptly.
• Secure hosting: The underlying infrastructure should be managed by a provider with appropriate security controls and a clear response process.
• Proactive maintenance: Software updates should be applied regularly, followed by appropriate functional checks.
• Access controls: Strong passwords, multi-factor authentication and appropriate user permissions help reduce the risk of unauthorised access.
• Reliable backups: Backups and tested recovery procedures provide an important safety net if something goes wrong.
• Ongoing monitoring: Emerging vulnerabilities and security advisories need to be assessed, with clear ownership of any required action.

PHP lifecycle management also deserves attention. Versions that have reached end of life no longer receive standard security updates, so upgrades should be planned rather than left until a critical vulnerability forces the issue.

Ultimately, security is a shared responsibility between the hosting provider, the development team and the organisation that owns the website.

Final thoughts: Website security is an ongoing commitment

PHP2Shell is a striking example of how a vulnerability deep within a widely used technology can have far-reaching consequences — and how AI is changing the pace of security research.

It is also a reminder that effective website security depends on more than installing updates and hoping for the best. It requires the right hosting environment, an understanding of the technology stack, and the ability to respond quickly when new threats emerge.

Further reading

For those interested in the technical detail and the wider implications of the incident, these are particularly useful resources:

• Wiz Research: PHP2Shell — AI uncovers critical PHP vulnerabilities — the research behind the discovery and the demonstrated impact.
• The PHP Foundation — the PHP team’s perspective on the vulnerabilities, disclosure process and lessons learned.
• Calif: PHP2Shell — additional research and historical context on the vulnerabilities.