PHP2Shell: What You Need to Know About the New Web Security Threat
A new cybersecurity threat known as PHP2Shell has become a major topic of discussion in the tech world. This is not a single attack, but rather two serious vulnerabilities (CVE-2026-109618 and CVE-2026-109619) discovered in the core of the PHP programming language. Since PHP powers nearly 70% of the world's websites, including WordPress, Drupal, and Joomla, the scale of this threat is significant.
What is PHP2Shell and why is it dangerous?
The PHP2Shell vulnerabilities have been assigned a severity score of 9.2 out of 10, placing them in the critical category. These flaws allow attackers to remotely execute malicious code on servers. In practice, a hacker can gain full control over a vulnerable server, modify website content, steal data, or redirect users to phishing sites.
The situation has been exacerbated by the fact that information regarding these flaws leaked before official patches were released. According to security experts, attempts by hackers to exploit these vulnerabilities began even before the official announcement. It is currently confirmed that PHP2Shell is being actively used for cyberattacks.
What should you do as a user?
It is important to note that as an average user, you do not need to install any special software or change your passwords. This is an issue that must be addressed by website administrators and hosting providers. The PHP team has already released emergency updates (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to resolve these flaws.
If you manage a website, contact your hosting provider immediately to ensure your server is updated. If your website uses older, unsupported versions of PHP (such as 8.1 or earlier), it is at particular risk, and it is recommended to temporarily take the site offline until security measures are implemented.
What to look out for while browsing
While patches are now available, basic security rules remain essential. In the coming days, you may encounter websites that are temporarily inaccessible, which is likely due to maintenance and updates. Be cautious of suspicious redirects and do not click on unknown files that start downloading without your permission. If a site behaves suspiciously, simply close your browser.
Although artificial intelligence (AI) helps attackers create exploits more quickly, it is also being used to improve defense mechanisms. The PHP2Shell incident serves as a reminder that security in the digital space is a continuous process, not a one-time action.