PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?

PHP, a widely-used programming language for building websites, has been hit by two critical vulnerabilities termed PHP2Shell. These flaws could allow hackers to take control of vulnerable servers without needing to log in. Unlike individual websites built on PHP, these vulnerabilities lie within the language itself, making it impossible for businesses to protect themselves solely with website-level security measures.

This discovery is attributed to independent researcher LCFR and AI-assisted security research from firms like OpenAI and Wiz. According to OpenAI, an AI model named GPT-5.6 Sol identified the flaw, while Wiz conducted an independent investigation. These vulnerabilities affect specific PHP versions, with fixes released on October 21, 2026. Businesses need to verify their current PHP version, install updates, and check if any hackers may have exploited the flaws before the fixes were applied.

Around 70% of websites globally run on PHP, but not all are at risk. The real danger depends on the PHP version, server configuration, and exposure to attacks. If left unpatched, hackers could remotely run malicious code on affected systems without needing authentication. This could lead to the exposure of sensitive information, changes to websites, or installation of malware.

Businesses, especially those handling sensitive data, should prioritize checking their internet-facing PHP systems that manage payment services, customer databases, and identity authentication tools. Smaller businesses or those relying on third-party hosting providers might face additional challenges. They might not know their PHP version or if updates have been installed, making it harder to protect their systems.

Once businesses identify affected systems, they must update the software to PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. There are no complete mitigations, so updating is crucial. Businesses must also verify if the patches were applied correctly. If immediate patching isn't possible, they should follow official guidance from PHP and their hosting or software providers to minimize exposure. Unsupported installations may need to be upgraded or isolated until they can be secured.

The PHP2Shell incident highlights the need for businesses to keep pace with AI-assisted vulnerability discovery. While it will potentially improve the overall security of the software ecosystem, it also underscores the need for robust partnerships between public and private sectors to rapidly build and deploy fixes.