PHP2Shell: who is exploiting it and what the darknet reveals

PHP2Shell is a serious flaw in PHP, the software that powers most of the world’s websites, and it lets an attacker take control of a website’s server without needing a password. PHP released a fix on 21 October 2026 and, just one week later, there were already confirmed attacks, free hacking tools on criminal forums and access to companies up for sale. At Byron Labs we have followed it closely with Vysion, our intelligence platform, to explain clearly what is happening: who is talking about it, how criminals are using it and what you should do.

What is PHP2Shell?

PHP2Shell is the nickname for a very serious security flaw in PHP, which runs 7 out of 10 websites, from a WordPress blog to an online store. It is actually two related problems, identified by the codes CVE-2026-109618 and CVE-2026-109619.

Both take advantage of the same moment: when PHP has to abandon a website visit halfway through because of an error, it does not always “clean up” properly. The attacker triggers that error on purpose and uses the mess left behind to run commands on the server remotely. The second flaw can also leak information the server keeps in memory, such as passwords, user sessions or access keys.

Why it’s so dangerous:

1. No password is needed, nor does anyone need to be tricked: all it takes is sending a specially crafted request to the website, without any user having to click on anything.
2. It’s in PHP itself, not in a plugin: it affects a huge number of websites at once. Researchers confirmed this in standard installations of WordPress, Drupal, and Joomla.
3. Standard security measures fail to work: login, authentication, and security plugins are bypassed because the vulnerability is triggered before the website executes its own code. As a result, sometimes there isn’t even a trace left in the website’s logs.

The good news is that there is a fix: PHP released patched versions on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 and 8.2.35). Updating and restarting PHP on the server is the only complete protection.

What real risk does PHP2Shell pose?

Two factors make PHP2Shell especially dangerous: the number of websites it can reach and how quickly criminals have started using it.

Millions of exposed servers

According to VirusTotal,there are about 5.1 million servers running PHP visible on the internet, and the vulnerability exists in all versions of PHP released over the past ten years. The biggest problem is the approximately 758,000 servers running older versions (from 5.4 to 8.1). They no longer receive official updates, so they may remain vulnerable for months or even years.

A greater risk than its score indicated

The severity of a flaw is measured on a scale called CVSS, from 0 to 10. PHP2Shell scored 9.2, but with the warning that it was “hard to exploit”, which could tempt some to wait. Reality turned out differently: in less than a week there were successful attacks, the US cybersecurity agency (CISA) added it to its list of flaws used in real attacks, and stolen access appeared for sale.

This is exactly what we explained in our article “Why CVSS No Longer Protects Your Company: CISA’s New Paradigm for Vulnerability Prioritization”: a technical advisory doesn’t say whether someone is already attacking, and that sign usually appears first on the dark web.

What the darknet reveals: what we saw with Vysion

Vysion monitors, every day, the hidden forums and Telegram channels where cybercriminals gather. Between 21 and 29 October it detected 65 Telegram messages and 5 forum threads about PHP2Shell, spread across seven different communities. In just nine days, the conversation went from asking how to use the flaw to selling stolen access.

The first thing that stood out was that criminal forums themselves, such as PwnForums and RaidForums, had to go offline on 21 and 22 October to protect themselves: they also run on PHP. From there, the race began to get an attack that worked. The first public versions failed, but by 22 October channels such as “Exclusive Hacking Tools” were already sharing an improved version that did work. On Russian-speaking forums such as ANTICHAT, translated news was posted almost daily and people looked for partners to make money from the access. On 27 October, a program appeared on the Breached forum that scans the internet for vulnerable servers, making it possible to find thousands of victims in hours.

Three Notable Cases

1. “Does anyone have one that works?”

From October 21 to 24, the same question was repeated on various Telegram channels: 

2. Access to Omani energy is for sale

On October 24, an ad titled "[PHP2SHELL] Oman's energy infrastructure Access + DB" appeared on the PwnForums marketplace. The seller was offering full access to and the database of Oman’s energy infrastructure for 35,000 USDT (a cryptocurrency equivalent to the U.S. dollar):

We have not been able to verify whether the breach is real, but it is the first specific victim linked to PHP2Shell in our data—and in a critical sector.

3. An attack tool, free for anyone

On October 25, a user on the PwnForums forum gave away a tool that detects vulnerable websites and installs a “backdoor” on them—a hidden way to gain access again whenever the attacker wants:

What all this tells us

1. Criminals react within hours, not weeks. The window for updating is minimal.
2. Technical difficulties don’t hold anyone back for long. Within 24 hours, there were already tools that worked.
3. The ultimate goal is money. Access credentials are sold and resold, and the victim may not find out until it’s too late.

Who is exploiting PHP2Shell?

There isn’t just one attacker. When a vulnerability like PHP2Shell emerges, these four types of criminals typically exploit it:

Type of attacker	Their goal	How They Operate
Networks of infected computers (botnets)	To add servers to their network to launch attacks or mine cryptocurrency.	They automatically scan the internet and attack all vulnerable servers they find.
Access sellers	They make money by selling access to a company.	They gain access to servers and sell that access on darknet forums, often to ransomware groups .
Opportunistic criminals	Stealing data, passwords, or credit card information from online stores.	They use tools that are freely available and attack websites that haven’t been updated, regardless of who owns them.
State-affiliated groups	Spying and maintaining covert, long-term access.	They choose specific targets, such as government agencies or critical infrastructure, and take care to leave no trace.

 

The most vulnerable are online stores (Magento, WooCommerce, Shopware), web hosting providers, and websites built with content management systems and tools such as Roundcube, phpMyAdmin, or Nextcloud, which store passwords and sensitive data.

How can you tell if you’ve been attacked?

There is no list of addresses or files that would indicate an attack, and PHP warns that the absence of errors does not mean you are safe. You need to look for unusual behavior. Here are the signs your technical team or provider should check for:

• In website traffic: file uploads to pages that never receive files, requests containing the PHP_SESSION_UPLOAD_PROGRESS field, a series of 500 or 502 errors, and session cookies (PHPSESSID) of an abnormal size.
• In server logs: “memory exhausted” errors immediately following those visits and unexplained PHP restarts.
• On the server itself (the clearest sign): PHP launching programs such as bash, PowerShell, curl, or wget; connections to unknown addresses; and .php files, administrator accounts, or scheduled tasks that no one created.

It’s advisable to review logs dating back at least to October 17, when the first attempts began.

What to do now: update, review, and monitor the dark web

In just ten days, PHP2Shell went from being a data breach to having free attack tools and stolen credentials up for sale. There’s no longer any time to wait to update, so the response must come on two fronts: lock the door and check to see if anyone has already gotten in.

1. Lock the door: update PHP

The first step is to determine which version of PHP each server is running:

PHP Version	Status	What to Do
8.5.12, 8.4.27, 8.3.36, or 8.2.35	Fixed, if PHP was restarted.	Verify that no one logged in before updating, and change passwords.
Previous versions from 8.2 to 8.5	Make money by selling the login credentials to a company.	Update to the fixed version.
8.1 or earlier	Steal data, passwords, or credit card information from online stores.	Use updates from the system vendor or upgrade to a modern version. CISA recommends disconnecting them in the meantime.
PHP included in other products or on Linux servers	Check for this.	Check with the manufacturer or vendor to see if the fix is already included.

 

In addition, PHP 8.2 will no longer receive updates as of December 31, 2026, so it’s a good idea to start planning for the next upgrade now. The recommended steps are:

• Identify all PHP instancesin the organization—including those embedded in other products—starting with those exposed to the internet.
• Before updating, test the servers that were exposed and save the test results. Updating does not remove a backdoor that is already installed.
• Update and completely restart PHP. Without a restart, the vulnerable version will continue to run.
• If you still cannot update, apply the temporary measures recommended by PHP (such as disabling the `session.upload_progress` option and blocking file uploads where it is not used) and keep the web application firewall (WAF) active. These measures help, but they are not a substitute for the update. If that is not possible, take the server offline.
• Change passwords and keys on any server that may have been exposed and close any open sessions.
  

2. Find out if anyone has already gained access: monitor the dark web with Vysion

Updating closes the door, but it doesn’t tell you if someone got through it earlier. The Oman case proves it: the first sign of a breach might be a for-sale ad on a forum, long before the victim notices anything on their systems.

This is where Vysion makes a difference. Our platform tracks hidden forums and Telegram and Discord channels where cybercriminals operate on a daily basis, and it allows you to:

• Detect whether your company is listed for sale: alerts when your name, domains, or servers are mentioned in ads for stolen access credentials.
• Find leaked credentials: passwords and employee or system data circulating after a breach, so you can change them before they’re used.
• Identify which vulnerabilities are actually being exploited: as we explained in our article on CVSS, a vulnerability’s score doesn’t indicate whether someone is already exploiting it. The dark web does, and that helps you decide what to patch first.

With PHP2Shell, Vysion has allowed us to follow, step by step, how the conversation among cybercriminals evolved: from the initial requests for tools to the sale of stolen credentials. Having that insight is what allows us to react in time, rather than finding out when it’s already too late.

Want to know if your organization is mentioned in criminal forums or channels? Contact Byron Labs, and we’ll check it out with Vysion.

Frequently Asked Questions About PHP2Shell

What is PHP2Shell?

It is the nickname for two very serious security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that allow an attacker to take control of a web server without a password. PHP fixed these vulnerabilities on October 21, 2026.

Is PHP2Shell being exploited?

Yes. There have been successful attacks since October 24, 2026, and CISA has included it on its list of vulnerabilities currently being exploited in real-world attacks. Access credentials obtained through this vulnerability are already being sold on the dark web.

Is my WordPress website affected?

Probably, if the server doesn’t have the latest version of PHP. The vulnerability is in PHP, not in WordPress, so updating WordPress or its plugins won’t fix it.

Which PHP versions fix the PHP2Shell vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Afterward, you’ll need to restart PHP on the server. Versions 8.1 and earlier do not have an official fixed version.

If I’ve already updated PHP, am I safe?

Not necessarily. If the server was previously compromised, a backdoor may have been left behind or a password may have been leaked. Check for signs of intrusion and change your credentials. Web firewalls help, but attackers are already adapting their attacks to bypass them.