What is PHP2Shell?
PHP2Shell refers to a pair of severe security vulnerabilities discovered in PHP — the technology behind the majority of websites worldwide. The flaws were made public on 21 October 2026.
Both flaws allow an unauthenticated attacker to execute arbitrary code on the server with the privileges of the PHP web worker process.
What does that mean for your business? No password is needed. No login screen to bypass. An attacker only needs to send a crafted request to your website to gain full control of the server. From there, the damage can include:
- Steal or destroy your entire database — customer details, orders, financial records, all of it
- Run up costs on your paid integrations — email providers like Mailgun or SendGrid, mapping APIs, payment processors, SMS gateways — anything with credentials on the server
- Plant hidden backdoors that survive even after the vulnerability is patched
- Use your domain to send phishing or spam, destroying your sender reputation
- Divert your visitors to fraudulent or harmful websites
- Encrypt your data and demand payment to release it
Exploitation is already underway. Cloudflare has confirmed attack traffic targeting these flaws, and an estimated 22.6 million servers* have been identified as exposed.