PHP
Open-source scripting language behind much of the web, maintained by the PHP project.
On 21 October, the PHP project patched two command-execution flaws rated 9.2, while PHP 8.1 and older received no fix and required a full upgrade.
Last refreshed: 22 October 2026 · Appears in 1 active topic
Can unsupported PHP sites migrate before working PHP2Shell exploits spread?
Timeline for PHP
Shipped fixed versions for two remote code flaws
Cybersecurity: Threats and Defences: PHP2Shell: no fix for PHP 8.1 and olderBackground
PHP is an open-source scripting language maintained by the PHP project. It underpins a large share of websites and runs code on web servers, which means a remote command-execution flaw can expose both the application and its host system.
On 21 October 2026, the PHP project shipped fixes for two flaws rated 9.2 that allowed unauthenticated attackers to run commands on a web server. Hundreds of sites, including Nintendo and Berlin's Charité hospital, had gone offline before the fixes appeared. PHP 8.1 and older received no upstream fix. Detectify researcher Joviane Jardim estimated that roughly half of PHP websites used those older releases, leaving a full upgrade as their route to the corrected code.
That split between maintained and unsupported branches makes version age part of the security boundary. Administrators on current releases could apply the project's fixes, while users of the older branches had to move to a supported version before receiving the corrected code.
What is PHP used for?
What PHP versions fix PHP2Shell?
Why must old PHP websites migrate after PHP2Shell?
How dangerous are the PHP2Shell flaws?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.