Is itCheck something

php2shell CVE-2026-109618

Hackers can take over websites running PHP without a login

Yes. Attackers are using this right now.

Anyone running a website on PHP, including most WordPress hosting.

Do this: Update PHP to the latest version, or ask your web host to do it.

Confirmed in attacksOct 26, 2026
ProductPHP Group PHP
CloudflareKnown exploited
GitHub repos100+
Social today744K

Hand it to your AI agent

Paste this into Claude, ChatGPT or your coding agent. It only looks, it does not change anything.

Read-only check, change nothing, send nothing anywhere.
Is PHP Group PHP (CVE-2026-109618) installed or running on this machine or in this project?
1. Find every copy and its version (apps, packages, containers, lockfiles).
2. Compare each version against the vendor's fixed version for CVE-2026-109618. Quote the vendor page you used.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / unsure).
4. List the exact update steps, but do not run them.
Download playbook (.md)

Part of php2shell

The official description

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

What people are saying

  • Unnamed account · 281K followers · instagram-post
    70% of the world’s websites are vulnerable 🚨 🌐 PHP runs WordPress, Wikipedia and online stores behind the scenes 🐛 PHP2Shell: hackers need just 1 request, no password or login, to take over a site 🤖 The bug sat there for 10+ years, deemed tOpen post
  • StudyIQ IAS · 20.6M followers · youtube-video
    Massive Cyberattack: What is PHP2Shell? Ankit Agrawal Study IQOpen post
  • S4vitar · 105K followers · tiktok-video
    Alerta crítica en PHP, actualiza antes de que sea tarde. Se acaban de publicar dos vulnerabilidades críticas en el núcleo de PHP, conocidas como PHP2Shell (CVE-2026-109618 y CVE-2026-109619), de ejecución remota de comandos sin autenticacióOpen post
  • Bebar Bilim · 1.5M followers · youtube-video
    Tüm Dünyada Siber Alarm! PHP2Shell Olayı (9.2/10)Open post

Social data by LunarCrush. Posts are shown as written; we do not vouch for them.

Code on GitHub

Repos named after this bug. Some are scanners or write-ups, some are working attack code. Do not run them on a machine you care about.

Sources