☕ TechTea explainer · Oct 26, 2026 · 5 min read

Your code was fine.
PHP wasn’t.

PHP2Shell, explained for someone who has never thought about how a website works. No jargon without a meaning next to it.

Last updated Oct 25, 2026

Tap to read the advisory ↗Check my PHP version

How does a website work?

A website isn’t stored on your phone. It lives on a server (a computer that’s always on, somewhere else). Every time you open a page, your browser sends a request (“please give me this page”), and the server sends back a response (the page itself).

☕ At the canteen

Think of the college canteen. You hand over an order slip, the counter passes it to the kitchen, a cook makes your dish, and the plate comes back to you. You never walk into the kitchen.

Try it: follow one request

Your browser

Web server

PHP

Database

At the canteenYou write an order slip and hand it over.

On the internetYou open a link. Your browser sends a request: “please give me /profile.php”.

1 / 5

You only see the plate. Everything important happens in the kitchen.

What is PHP?

Your Instagram feed is different from your friend’s, so the server can’t keep one ready-made page for everyone. Something has to build each page fresh. PHP is a programming language that does exactly that, on the server: it’s the cook, and each .php file is a recipe.

hello.php

<?php
// The server runs this for every visitor, then sends back only the HTML.
$name = "Priya";
echo "<h1>Hello, $name!</h1>";

Isn’t PHP old? Who still uses it?

A lot of the internet. PHP runs about 70% of websites whose server language is known (W3Techs, Aug 2026), including WordPress sites and Wikipedia.

If PHP has a problem, a huge part of the web has a problem.

What went wrong?

PHP2Shell is the nickname for two bugs found inside PHP itself: CVE-2026-109618 and CVE-2026-109619 (a CVE is a public ID number for a security bug). Both are mistakes in how PHP looks after its memory (the computer’s short-term workspace) while it handles a request.

☕ At the canteen

Your recipe was perfect. The problem was in how the cook keeps the kitchen counter. Since every restaurant hired the same cook, every restaurant had the same problem.

So did my code cause it?

No. The bugs sit underneath your code, in PHP. That’s why a site with perfectly written code was still at risk, and why only updating PHP fixes it.

When did this happen?

PHP announced a critical security release on 20 Oct 2026, details leaked online early, and the fixes shipped on 21 Oct. The bugs were found by security researchers from Wiz, Calif and OpenAI.

Why is it so serious?

No login needed

Anyone on the internet could try it, without an account.

Every PHP site

It affects PHP installations that serve web pages, whatever app runs on top.

Full takeover

In the worst case, a stranger can run their own code on the server.

That last one has a name: remote code execution (RCE), meaning someone far away makes your server run commands of their choice. A shell is a server’s command line, so “PHP to shell” became PHP2Shell. With that access, an attacker could read your database, steal users’ data or use your server to attack others.

Security teams score bugs from 0 to 10 using CVSS. Both of these scored 9.2, which is “critical”.

Same cook in millions of kitchens, no lock on the kitchen door.

Am I affected?

Every PHP version before the fixed releases is affected. Find your version with this command in a terminal:

terminal

php -v

Try it: is my PHP version patched?

8.3.30 is affected. Update to 8.3.36 or newer.

Your branch	Safe from
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1 and older	No official fix: upgrade, or get a vendor backport

Installed PHP from Linux packages (apt, dnf)? Distributions often patch without changing the main number, so also check your distribution’s security notice.
Using XAMPP or WAMP for college projects? They bundle their own PHP. Update them too, especially if your laptop server is reachable from other devices.
Can’t update today? The advisory lists temporary settings, but PHP says plainly that only updating is a complete fix.

What should engineers learn?

1
Your app stands on other people’s code. Languages, runtimes and libraries need updates as much as your own code does.
2
Error paths are code too. Plenty of serious bugs live in the “what if something fails halfway?” path that nobody tests.
3
Memory safety matters. PHP itself is written in C, where memory mistakes are easy. That’s why languages like Rust and Go are popular for new systems.
4
Never run random “exploit” code from GitHub. Fake proof-of-concept repos appeared within days of this bug, and fake exploit repos are a known way to spread malware.

2-minute recap

Request: Your browser asking a server for a page.
PHP: The “cook” on the server that builds pages for about 7 in 10 websites.
PHP2Shell: Two critical bugs in PHP itself, patched on 21 Oct 2026.
Your code: Wasn’t the problem. The bugs are in PHP, under your code.
Remote code execution: A stranger runs their own commands on your server, no login needed.
The fix: Update to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer.

Official documentation

The real details, straight from the PHP project. Start with the first link.

The canteen analogy is simplified on purpose. PHP usage figure: W3Techs, Aug 2026. This page explains what happened and how to stay safe; for technical details, read the advisories above.