PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?

by · Inc42

SUMMARY

  • Two critical flaws in PHP could allow hackers to run malicious code on vulnerable servers without logging in.
  • Websites, online businesses and enterprise applications could face data theft, service disruption and unauthorised access.
  • Rated 9.2 out of 10 for severity, the vulnerabilities were patched on October 21, 2026, but businesses must still check for exposure and possible attacks.
  • Added to Saved Stories in Login

PHP, a programming language used to build websites, is at the centre of a major security concern after researchers uncovered two critical flaws that could let hackers take control of vulnerable servers.

Called PHP2Shell, the vulnerabilities could let attackers run malicious code on affected systems without needing to log in. Since the vulnerabilities lie in PHP itself rather than individual websites built on it, businesses cannot rely on website-level security measures alone to stay protected.

The vulnerabilities affect specific PHP versions, and fixes were released on October 21, 2026. Businesses must now check whether they are running affected versions, install the updates and investigate whether hackers exploited the flaws before the fixes were applied.

The discovery story involves both independent research and AI-assisted security work. Security firm Calif credited pseudonymous researcher LCFR with first discovering PHP2Shell and developing a working exploit. Separately, AI company OpenAI said security research firm Calif identified a critical flaw using its GPT-5.6 Sol model, while cybersecurity firm Wiz independently discovered and reported both vulnerabilities. OpenAI’s disclosure describes the collaboration that helped prepare fixes before public disclosure.

The episode also highlights a growing cybersecurity concern: AI tools are helping researchers uncover complex security flaws, but organisations must be equally agile to fix them.

Which Businesses Face The Risk?

PHP powers around 70% of websites globally. This highlights the language’s reach, but does not mean that 70% of websites are vulnerable. The actual risk depends on the PHP version, server configuration and exposure to attack. The vulnerabilities can allow attackers to run code remotely on affected servers without authentication.