PHP2Shell: The Unsung Hero Who Saved Millions of Websites — and Why You Must Still Patch

While the whole internet panicked over PHP2Shell, one quiet volunteer in the Czech Republic did the unglamorous work that protected millions of websites. Nobody knew his name. He did it in his spare time, for free, as he has done for more than twenty years. This is his story, and the warning it carries for every website owner.

The Man Behind the Fix

His name is Ondřej Surý. By day, he is director of DNS engineering at the Internet Systems Consortium, a US non-profit. But for over two decades, in his own time, he has maintained the PHP software packages that power Debian and Ubuntu Linux, the systems running a huge share of the world’s web servers.

When two critical PHP flaws were discovered with the help of AI, and the PHP project released emergency fixes on 21 October 2026, Surý dropped everything. His job was to turn those raw fixes into easy-to-install packages, so that ordinary website operators could patch their systems quickly instead of wrestling with source code in the middle of a global security scramble. Without that step, the fix would have reached far fewer servers, far more slowly.

Here is the twist the headlines usually skip: the internet runs on free labour like his. Giant tech companies earn billions from open-source software maintained by volunteers. When the crisis hit, the public responded in kind. Surý received more than $10,000 in donations within a few days, roughly a year’s worth of contributions, and he used the moment to say what maintainers have said for years: the companies that depend on this software should do far more to support it.

What Is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 (Critical). Either one lets an attacker run code on a web server without logging in at all.

In plain terms, the first flaw corrupts PHP’s internal state when a request runs out of memory part-way through, and the cleanup routine then trusts that broken data. The second leaves internal state from one request lingering after its memory has been freed, so a later request handled by the same worker can act on it. Both end in the same place: remote code execution, with the attacker running commands as the web server user.

Why Updating WordPress Is Not Enough

This is the part most website owners miss. PHP2Shell lives in the PHP runtime, not in WordPress, your theme, or your plugins. Your site can be fully up to date, your admin area can sit behind two-factor login, and the server can still be taken over, because the vulnerable code runs while PHP is reading the request, before your application gets a say. Updating the CMS and updating PHP are two separate jobs, and both matter.

Which Versions Are Affected, and the Fix

Every supported PHP version before the fixed releases is affected, and the flaws reach back to code paths from 2012. Update to one of these releases or later:

PHP 8.1 and earlier are past official support, so no new releases exist for them. Community backports are available for some older branches through package managers, but these are a stopgap. If your site still runs PHP 8.1 or older, moving to a supported version is now urgent, not optional.

Is PHP2Shell Being Exploited?

Yes. Amazon’s threat intelligence recorded an exploitation attempt on 17 October, four days before the fix was public, and security firms now report broad exploitation attempts. Proof-of-concept code circulated before the patch shipped. Cyber agencies in Canada, the UK, Singapore and the US state of New York have all issued alerts urging immediate patching. If your PHP installation faces the internet and is unpatched, assume it is being targeted.

All common PHP setups are at risk, including PHP-FPM, php-cgi, FrankenPHP, LiteSpeed and Apache’s mod_php. The PHP project rates mod_php as the highest risk, because a demonstrated exploit works over HTTP before any application code runs.

What To Do Right Now

1. Check your PHP version. Your hosting control panel usually shows it, or ask your host. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 on its branch needs attention.
2. Update PHP to a fixed release and restart all PHP workers afterwards, or the old code keeps running.
3. Test your site after the update. Version changes can break old plugins or code, so check key pages, forms and checkout before calling it done.
4. Check for signs of compromise if your server was unpatched during the exposure window: unexpected files, new admin users, strange scheduled tasks, or outbound traffic you cannot explain.
5. If you cannot update today, ask your host about a web application firewall rule for these attack paths, and treat it as a temporary shield only. It is not a substitute for patching.

How To Check Your PHP Version

Log in to your hosting panel and look for the PHP version selector, usually under “Select PHP Version” or “PHP Settings”. If you have server access, php -v tells you instantly. Not sure where to look? Your hosting provider’s support team can confirm it in one message.

The Warning That Matters Most

Surý’s warning is the part to remember. AI is accelerating the discovery of vulnerabilities, which means incidents like this could happen more frequently in the near future. The next scramble may not come with a hero working through the night. Patching promptly, and supporting the people who maintain the software we all depend on, is no longer someone else’s job.

Frequently Asked Questions