PHP2Shell: what happened, and what you can do now
Two critical vulnerabilities in PHP sent thousands of sites offline on 21 October 2026. Here is what happened and what the steps are.
On the morning of 21 October 2026, two critical security flaws in the PHP programming language were made public before a fix was ready. Within hours, government websites, hospitals, football clubs, media companies and universities across the Netherlands and Belgium took their sites offline. DigiD went dark. The NCSC, the Dutch national cyber security centre, took its own website down as a precaution.
Here is what happened, and what it means for you.
What is PHP?
PHP is the programming language that runs the server-side code of roughly 70% of all websites. Every WordPress, Drupal, Joomla and TYPO3 site runs on it. Many custom-built web applications do too. It has been around since 1995, and despite its age it remains the backbone of most of the web.
The flaw
Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, scored 9.2 out of 10 on the standard severity scale. Security researchers nicknamed them "PHP2Shell".
The flaw allows an attacker to run arbitrary code on your server over the internet, without needing a username or password. All PHP versions from PHP 5 onwards are affected. That covers practically every PHP version ever released.
The PHP Foundation made a patch available at 16:00 on 21 October, but only for PHP 8.x. Older versions (PHP 7, PHP 5) have reached end of life and will not receive a fix.
What should you do?
- Find out whether your site runs PHP. Ask your hosting provider or web builder. WordPress, Drupal, Joomla and TYPO3 all run on PHP.
- Update PHP. Log in to your hosting control panel (cPanel, Plesk or similar) and look for a PHP version setting. Update to the latest PHP 8.x release. If you cannot do this yourself, contact your hosting provider today and ask for an update.
- If you are still on PHP 7 or PHP 5, treat this as urgent. No patch will be released for those versions. Upgrading to PHP 8 requires testing your site first. If your site handles sensitive data, consider taking it offline temporarily until the upgrade is done.
-
After updating, verify the version. Most hosting panels show the
current PHP version. Alternatively: if your server sends an
X-Powered-By: PHP/8.x.yresponse header, confirm that the version number matches the latest release.
How does Noroshi detect this?
Many web servers include the PHP version in the X-Powered-By response
header, for example X-Powered-By: PHP/8.2.27. Noroshi reads this header
during every scan and compares the detected version against our vulnerability database,
which is synced daily from CIRCL, the EU-operated vulnerability intelligence service.
When the version matches a known CVE, a finding appears in your dashboard with the exact version, the CVE identifier and a step-by-step fix. Once CVE-2026-109618 and CVE-2026-109619 are indexed, any monitored domain whose server exposes a vulnerable PHP version will show the finding on the next scan.
This is entirely passive: we read the information your server already sends with every page request. We do not run exploit attempts or send payloads of any kind.
If your server does not expose the PHP version in its response headers, which is in itself good practice, we cannot detect it this way, and no finding is raised.
The broader point
PHP2Shell is a reminder of a basic truth: the software that runs your website is also the target. Vulnerabilities like this are discovered regularly, and attackers move fast once a flaw is published.
You cannot prevent vulnerabilities from being discovered. You can choose to hear about them quickly and act before an attacker does.
Written by David Hildering, the engineer behind Noroshi. More about Noroshi.